EUVD-2026-93964
GHSA-rrrh-972c-gp58
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAssociate to captive-portal SSID
-
ExploitSend crafted HTTP request
-
ExecutionTrigger null pointer dereference crash
-
ImpactRepeat at low rate for persistent DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Captive Portal feature be enabled on an SSID, and that the attacker be a wireless client associated to that captive-portal-enabled SSID (AV:A adjacent wireless access - not reachable from the general internet). No portal authentication is required (PR:N). Limiting factors: the flaw is unexploitable if Captive Portal is not configured; the attacker needs physical/RF proximity to associate; impact is confined to availability of the captive portal service with no data exposure or code execution; and because the service auto-restarts, a single crash is self-healing, so a persistent outage requires a sustained low-rate flood of crafted requests. |
| Impact | This is a moderate, availability-only issue rather than a top-tier priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.1 driven entirely by VA:H - all confidentiality and integrity impacts are None, and the description explicitly states remote code execution is not possible, so the 'RCE' tag contradicts the actual vulnerability. Critically, the attack vector is Adjacent (AV:A), not Network: the attacker must be a wireless client associated to a captive-portal-enabled SSID, which meaningfully limits exposure compared to an internet-facing flaw. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic impact is a repeatable denial of service of the captive portal (the service auto-restarts, requiring a sustained low-rate attack to maintain outage), not host compromise. Net: a legitimate availability concern for guest/captive-portal Wi-Fi, but not a widespread-exploitation emergency. |
| Exploit ScenarioDerived | An attacker within wireless range associates to a captive-portal-enabled SSID (no credentials required for the portal handshake) and sends crafted HTTP requests that trigger a null pointer dereference in the portal service, crashing it. Because the service restarts automatically, the attacker sends a sustained low-rate stream of these requests to keep the captive portal continuously unavailable, blocking onboarding of legitimate guest users. No public exploit code is identified at time of analysis; AV:A/AC:L means the attack is straightforward but requires wireless adjacency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Crafted HTTP requests sent by an unauthenticated wireless client associated to a captive-portal-enabled SSID can crash the Captive Portal service on affected Arista Wi-Fi access points, and a sustained low-rate flood of such requests can keep the portal persistently unavailable (CVSS 7.1, availability-only, no confidentiality or integrity impact and no remote code execution). Exploitation is limited to the wireless adjacency: the attacker must be within RF range and associated to a captive-portal SSID, and access points without Captive Portal configured are not exposed. Because the portal process restarts automatically after each crash, a single request is self-healing; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
RemediationAI
The primary fix is to install the corrected firmware release identified in Arista Security Advisory 0194 (https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194); patch availability is confirmed by the vendor advisory, but the exact fixed version string is not present in the provided data, so verify the specific firmware build from the advisory before scheduling the upgrade. Where immediate upgrade is not feasible, disable Captive Portal on any SSID that does not require it, which removes the exposure completely at the cost of breaking guest onboarding and portal-based redirection for those SSIDs. For SSIDs that must keep a portal, confine them to a dedicated guest WLAN with minimized RF footprint and reduced transmit power so that association requires close proximity, and enable alerting on repeated captive portal service restarts to detect a sustained crash flood; if the AP or controller platform supports HTTP request rate limiting for the portal, apply throttling, accepting that aggressive limits can delay legitimate client onboarding. Note that because the attack is wireless-adjacent and requires association to the captive-portal SSID, perimeter firewall or internet-facing filtering offers no mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a null pointer dereference (CWE-476) in the HTTP request-handling path of the Captive Portal web service that Arista Wi-Fi access points run to intercept and redirect unauthenticated guest clients. A specially formed HTTP request causes the portal process to dereference a null pointer, abort, and be restarted by the platform's service supervisor; there is no evidence of memory corruption leading to code execution, and the advisory explicitly states RCE is not possible, so the 'RCE' tag in the source metadata should be treated as advisory tagging rather than a demonstrated impact. The CVSS 4.0 vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N describes an adjacent-network (wireless) attack requiring no portal authentication and no user interaction, with high availability impact on the vulnerable service only and no subsequent-system impact. Our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with this: the practical constraint is that the attacker must associate to the captive-portal SSID, and the sustained-outage outcome depends on a continuous low-rate stream of crafted requests rather than a single packet.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent wireless association required (AV:A), low complexity and no auth for portal handshake (AC:L/PR:N), availability-only null-deref DoS so C:N/I:N/A:H.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
Lifecycle Timeline
2DescriptionCVE.org
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
Executive ViewAI
The vulnerability affects Arista Wi-Fi access points with Captive Portal enabled, where the portal service can crash or remain unavailable, disrupting access for users of that SSID. The impact is availability-only and requires an attacker within wireless range associated to a captive-portal SSID; no data confidentiality, integrity, or remote code execution impact has been reported. No public exploit identified at time of analysis and no vendor-released patch is identified, so leadership should prioritize inventory, temporary mitigations, and vendor tracking over emergency containment.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling Captive Portal on affected Arista Wi-Fi access points where not required, restricting captive-portal SSIDs to necessary RF coverage, rate-limiting HTTP requests to the portal, monitoring for repeated portal process restarts, and applying any Arista-provided workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB