Arista Access Points EUVD-2026-93965

Exploitation requires that the affected Arista access point has the Wireless Intrusion Prevention System (WIPS) sensor service active - this is the specific feature that processes the crafted frame, so APs without WIPS enabled are not in scope. The attacker must be within radio-frequency (RF) proximity of the target AP (AV:A / Adjacent), which is the primary limiting factor and precludes remote internet-based attack. No wireless association, authentication, or user interaction is required (PR:N/UI:N), and the frame is accepted pre-association, so against a WIPS-enabled AP there are no additional configuration or credential prerequisites beyond physical radio range.

This is a credible operational-priority issue for environments running Arista wireless infrastructure, but not a mass-internet-exploitation emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) scores 8.7 (High): exploitation is unauthenticated, low-complexity, and requires no user interaction, which raises concern. The decisive mitigating signal is the Adjacent (AV:A) attack vector - the attacker must be within RF proximity of the access point, so this cannot be exploited remotely across the internet and is not 'automatable' at internet scale, meaning realistic exploitation is proximity-bound and likely targeted rather than widespread. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation. The CWE-787 (out-of-bounds write) classification plus the RCE/Buffer Overflow/Memory Corruption tags are consistent with the description's RCE claim, but the description hedges ('or potentially achieve remote code execution'), so full code execution is plausible yet not confirmed-demonstrated; the confirmed impact is a denial of the WIPS sensor service. A security-visibility angle sharpens the risk: a crafted frame can silently disable WIPS monitoring, blinding the detection control itself, which an attacker could stage before further wireless attacks. Net: prioritize patching for Arista WIPS-enabled deployments, but RF-proximity requirement keeps this below a drop-everything remote-RCE event.

An attacker physically within wireless radio range of an affected Arista access point running WIPS transmits a specially crafted 802.11 frame without associating or authenticating to the network. The malformed frame triggers an out-of-bounds write in the sensor service, crashing it to disable WIPS monitoring and potentially leading to code execution on the AP. No public exploit code was identified at time of analysis; the low attack complexity and lack of required interaction make opportunistic abuse feasible for anyone in RF proximity.