Arista Wi-Fi APs CVE-2026-102165

Exploitation requires that the access point's packet-capture service be running in a non-default, uncommonly used streaming mode - per the vendor description, default-configured devices are not exposed. The attacker must also have adjacent network access (CVSS AV:A - same Layer-2/wireless segment or local network, not internet-routable) to reach the capture service. No authentication (PR:N) and no user interaction (UI:N) are needed, but the AT:P metric and the explicit configuration dependency are the primary limiting factors: the window of exposure is confined to deployments that have deliberately enabled the streaming capture feature, substantially narrowing the realistic attack surface.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, base 7.7 HIGH) shows an unauthenticated attacker needing only adjacent-network access and low complexity, with full confidentiality/integrity/availability impact - attractive on paper. However, two signals sharply temper real-world risk: AV:A means the attacker must be on the same adjacent/Layer-2 or wireless segment, not the open internet, and AT:P (attack requirements present) reflects the vendor's own statement that exploitation needs 'an uncommonly used non-default streaming mode' on the capture service. CWE-121 (stack-based buffer overflow) and the RCE tag indicate code-execution potential, but the vendor hedges with 'crash or potentially achieve remote code execution,' so reliable RCE is not confirmed. No EPSS score, no CISA KEV listing, and no public POC were provided - exploitation status is therefore 'no public exploit identified at time of analysis.' Net: a real HIGH-severity flaw in affected devices, but the adjacency requirement plus non-default configuration dependency make widespread opportunistic exploitation unlikely; prioritize patching for environments that actually enable the streaming capture mode.

An attacker who has gained a foothold on the same local or wireless network segment as an affected Arista Wi-Fi access point (for example, via a rogue client or compromised host) sends a specially crafted packet to the device's packet-capture service while the non-default streaming mode is enabled. Because the vector is adjacent (AV:A) and unauthenticated (PR:N) with low attack complexity, this requires no credentials or user interaction, triggering a stack buffer overflow that crashes the service or potentially executes attacker code. No public exploit code was identified at the time of analysis.