Arista Wi-Fi Access Points CVE-2026-102167

Exploitation requires the attacker to have Layer-2/adjacent-network access to the same network segment as the access point's WIRED UPLINK (AV:A) - it is not exploitable from arbitrary remote/internet locations. The vulnerable surface is specifically the AP's wired-uplink network endpoints; no authentication (PR:N) and no user interaction (UI:N) are needed. The CVSS 4.0 AT:P metric indicates a specific precondition must be met for successful exploitation, and the description qualifies code execution as only 'potential,' meaning the dependable outcome is a crash of the sensor service while full RCE is condition-dependent. The primary limiting factor for defenders is network positioning: an attacker must already be able to reach the uplink segment, so segmentation of management/uplink VLANs materially reduces exposure.

This is a genuinely high-priority flaw whose real-world risk is meaningfully constrained by its attack vector rather than inflated by it. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N) confirms unauthenticated exploitation (PR:N) with low complexity (AC:L), but critically requires adjacent-network positioning (AV:A) - the description explicitly states the attacker must be on the same network segment as the AP's wired uplink, so this is NOT internet-remote and cannot be sprayed across the public internet. The AT:P (attack requirements present) metric signals that a specific condition must hold for exploitation, which tempers the reliability of the worst-case outcome; consistent with this, the description frames RCE as only 'potentially' achievable while the crash/DoS of the sensor service is the confirmed impact. CWE-121 (stack-based buffer overflow) with all impact metrics High (VC/VI/VA:H and subsequent-system SC/SI/SA:H) drives the 9.0 score. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation - the 9.0 reflects potential severity, not demonstrated attacker interest. Net: a serious vulnerability warranting prompt patching on exposed segments, but the adjacency requirement and attack-requirement condition make mass exploitation unlikely; prioritize based on whether attackers can reach the wired uplink segment (e.g., via a compromised internal host).

An attacker who has already gained a foothold on the internal LAN segment carrying the access point's wired uplink (for example, via a compromised workstation or a rogue device plugged into the same switch) sends crafted packets to the AP's wired-uplink network endpoint, triggering a stack-based buffer overflow in the sensor service. This reliably crashes the sensor service (DoS) and may, under the right conditions, lead to remote code execution on the access point without any authentication. No public exploit code is known at time of analysis, so this would require the attacker to develop the exploit.