Arista CloudVision CUE: Source IP spoofing leads to administrative access
Summary
CloudVision CUE (CV-CUE), the Wi-Fi management backend in on-premises deployments, can be abused by forging the source IP address. An unauthenticated attacker on an adjacent private network, or one routed through a reverse proxy or load balancer that forwards client headers, can gain administrative session privileges. The vulnerability is only exploitable when the wifimanager backend is enabled and running.
Affected
- Arista CloudVision CUE on-premises, versions 2021.2.0 to 2026.2.0 (default: unaffected)
- Only deployments where the CV-CUE backend (wifimanager) is enabled and running
- Cloud-managed deployments are out of scope according to the vendor
- Exact affected builds of older branches: Unknown.
Fixed in
- Arista CloudVision CUE 2026.2.1 and later
- Fixed builds for older branches: Unknown.
Workaround
- No mitigation or workaround available according to Arista.
- Restricting access to the CV-CUE backend to trusted management networks and ensuring that reverse proxies do not allow clients to set forwarded source IP headers reduces exposure. Verify these steps with the vendor before changing production systems.
Exploitation
- Arista is not aware of any malicious exploitation in customer networks.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found in the research. This is not proof that none exists.
- Not listed in the KEV catalog according to the sources.
Our recommendation
- Check whether on-premises CV-CUE is in use and whether wifimanager is running (cvpi status wifimanager).
- Upgrade to CloudVision CUE 2026.2.1 or later.
- Until patched, restrict access to the management interface to trusted networks and review reverse proxy header handling.
- Monitor administrative logins on the CV-CUE backend for unexpected activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0190 www.arista.com
- OpenCVE CVE-2026-102161 app.opencve.io
- Canadian Centre for Cyber Security AV26-1015 www.cyber.gc.ca
- Arista Security Advisory 0191 (different CVE, LDAP mitigation) www.arista.com
- Strix CVE-2026-102161 www.strix.ai
- Threatint CVE-2026-102161 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:27.
Original description (NVD)
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.