Arista Wi-Fi EUVD-2026-93962

Exploitation requires that the affected Arista Wi-Fi access point has the captive portal feature OR the application firewall feature enabled on at least one SSID - if neither feature is enabled, the vulnerable wireless gateway code path is not exposed. The attacker must be network-adjacent (AV:A): within wireless range or on an adjacent network segment, not reachable from the general Internet. No authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factors are therefore the non-universal, configuration-dependent feature requirement and the adjacency constraint; the automatic restart of the crashed service removes any practical limit on repeated attempts.

This is a credible high-priority issue but with important caveats. The input CVSS 4.0 score of 9.4 (Critical) reflects an unauthenticated (PR:N), low-complexity (AC:L) attack with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. The attack vector is Adjacent (AV:A), NOT fully remote/Internet-facing, which meaningfully limits exploitation to attackers already within wireless range or on an adjacent network segment - a significant mitigating factor not captured by the headline score. No EPSS probability was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of real-world exploitation (no public exploit identified at time of analysis). A signal conflict is worth flagging: the Tags assert 'RCE', but the description hedges code execution as 'potentially execute arbitrary code,' while the denial-of-service outcome is stated with more certainty - treat confirmed impact as DoS with RCE as a plausible but unverified escalation. The auto-restart behavior of the wireless gateway service amplifies risk because it enables repeated/sustained exploitation (persistent DoS, or repeated RCE attempts). Net: a real priority for organizations running Arista Wi-Fi APs with captive portal or application firewall enabled, but the adjacency requirement and conditional feature dependency place it below an Internet-wide wormable critical.

An attacker within wireless range of (or on a network segment adjacent to) an Arista Wi-Fi access point that has captive portal or application firewall enabled on at least one SSID sends a crafted packet to the wireless gateway service, triggering a stack-based buffer overflow. This crashes the service (denial of service) and may allow arbitrary code execution; because the service automatically restarts after a crash, the attacker can retry repeatedly. No public exploit identified at time of analysis.