Arista Access Points CVE-2026-102164

Exploitation requires the access point to be configured with BOTH VXLAN tunnelling AND L2-proxy - the specific, non-default VESPA use-case configuration called out in the description (reflected by AT:P in the CVSS 4.0 vector). The attacker must be a wireless client successfully associated to the tunnelled SSID, giving adjacent network access (AV:A) rather than remote internet reach. Limiting factors: APs not running the VESPA VXLAN+L2-proxy configuration are unaffected; the attacker needs wireless proximity and SSID association; and the outcome is confined to memory disclosure (VC:L) with no write, integrity, or availability impact, bounding realistic risk well below the raw product footprint.

This is a low-priority issue despite the alarmist tags. The vendor-supplied CVSS 4.0 base score is 2.3 (Low), driven by AV:A (adjacent - attacker must be a wireless client associated to the target SSID), AC:L, AT:P (a specific non-default VESPA configuration must be present), PR:N, UI:N, and impact limited to VC:L with VI:N/VA:N (read-only information disclosure, no integrity or availability impact). CWE-125 (out-of-bounds read) is consistent with this, and the description explicitly states 'No write primitive or remote code execution is possible.' No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so the exploitation signal is: no public exploit identified at time of analysis. CONFLICT TO NOTE: the input Tags include 'RCE' and 'Buffer Overflow,' which directly contradict both CWE-125 and the vendor's explicit statement that no write/RCE primitive exists - these tags should not drive prioritization. The attack-requirement (AT:P) and adjacent vector mean real-world exposure is confined to the narrow set of APs running VXLAN tunnelling plus L2-proxy, so this is a genuinely low-risk, limited-scope disclosure bug rather than a high-urgency flaw.

An attacker within wireless range associates to a VESPA-configured tunnelled SSID on an affected Arista access point and sends a crafted packet that triggers an out-of-bounds read, causing the AP to emit fragments of its memory into observable network traffic. Because the vector is adjacent (AV:A) and complexity is low once the specific configuration is present, exploitation is straightforward for an on-network wireless client, but impact is limited to confidentiality (memory disclosure). No public exploit code was identified at time of analysis.