EUVD-2026-93963
GHSA-v59j-jpcg-c5vq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAssociate to Captive-Portal SSID
-
DeliverySend crafted HTTP request
-
ExploitTrigger integer underflow in portal parser
-
ExecutionCrash portal service
-
ImpactTemporary denial of service until auto-restart
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Exploitation requires the Captive Portal feature to be explicitly enabled on an SSID (a non-default, operator-configured mode) and the attacker to be a wireless client associated to that Captive-Portal-enabled SSID - i.e., within radio range (AV:A, adjacent), not reachable from the general internet. No authentication is needed (PR:N) and no user interaction (UI:N) once associated. Limiting factors: the feature must be turned on, the attacker needs wireless adjacency to the vulnerable AP, and impact is bounded to a temporary portal-service outage that recovers automatically on restart with no RCE, data exposure, or persistence. |
| Impact | This is a moderate, availability-only issue whose 7.1 CVSS 4.0 score is driven entirely by VA:H (high availability impact) with VC:N/VI:N - there is no confidentiality or integrity exposure, and the vendor explicitly states remote code execution is not possible, which directly contradicts the 'RCE' tag in the input metadata. The attack vector is AV:A (adjacent), not network, meaning the attacker must be an associated wireless client within radio range of a Captive-Portal-enabled SSID - a meaningful constraint that the raw score does not emphasize. AC:L/PR:N/UI:N indicate the crash is trivially triggerable without authentication or interaction once that wireless proximity and feature prerequisite are met. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation; the realistic impact is a transient service outage that self-recovers on automatic restart. Net assessment: a legitimate availability bug worth patching on affected APs, but not an urgent, widespread-exploitation priority - it is a bounded, self-healing DoS reachable only from wireless adjacency against a non-default configuration. |
| Exploit ScenarioDerived | An attacker within wireless range associates to an SSID that has Captive Portal enabled (no credentials needed to reach the portal), then sends a single crafted HTTP request that triggers an integer-underflow condition (CWE-191) in the portal service. The service crashes, denying captive-portal access to other clients until it automatically restarts; no code execution or data access occurs. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
A crafted HTTP request from an unauthenticated wireless client associated to a Captive-Portal-enabled SSID can crash the Captive Portal service on Arista Wi-Fi access points, causing a temporary denial of service until the service automatically restarts. Exploitation requires the Captive Portal feature to be explicitly enabled (non-default) and the attacker to be within wireless range; it is not reachable from the general internet. The vendor confirms remote code execution is not possible, and no public exploit code has been identified at time of analysis.
RemediationAI
Patch available per vendor advisory: apply the fix referenced in Arista Security Advisory 0194 (https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194). If immediate patching is not possible, disable the Captive Portal feature on SSIDs where it is not required; this removes the attack surface but may prevent guest or captive portal authentication. Additionally, restrict physical proximity to the access point and monitor for repeated portal service restarts. The service automatically restarts, so the denial of service is temporary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Captive Portal service running on Arista Wi-Fi access points, which processes HTTP requests from wireless clients seeking network access. CWE-191 (Integer Underflow) indicates that a crafted request triggers an arithmetic underflow, likely leading to a memory handling error that crashes the service. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) and the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) both confirm that exploitation is limited to adjacent wireless clients without authentication, with high availability impact but no confidentiality or integrity impact. The 'RCE' tag present in some metadata is contradicted by the vendor advisory, which explicitly states remote code execution is not possible.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent wireless access gives AV:A; no auth or interaction (PR:N/UI:N); impact is confined to availability (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
Lifecycle Timeline
2DescriptionCVE.org
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.
Executive ViewAI
A vulnerability in Arista Wi-Fi access points with Captive Portal enabled can allow a nearby wireless client to crash the Captive Portal service, causing a temporary denial of service for users attempting to connect. This impacts organizations that offer guest or public Wi-Fi access, potentially disrupting visitor experience and requiring IT intervention until the service automatically restarts. While remote code execution is not possible and no public exploit has been identified, leadership should ensure that non-essential Captive Portal deployments are disabled and that monitoring is in place.
Disable Captive Portal on affected SSIDs; restrict wireless access to trusted users; monitor for service crashes; ensure automatic restart is enabled; apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB