Arista Wi-Fi Access Points: Stack-based buffer overflow in wireless gateway service
Summary
Arista Wi-Fi access points with captive portal or application firewall enabled on at least one SSID contain a stack-based buffer overflow in the wireless gateway service (CWE-121). An unauthenticated attacker on the local network or within Wi-Fi range can send a crafted packet, which may cause a denial of service or potentially execute arbitrary code on the device. The service restarts automatically after a crash, so repeated attempts are possible. The CVSS 4.0 score is 9.4 (Critical).
Affected
- Arista Wi-Fi access points, 22.0.0 up to and including 22.0.1F-32
- Arista Wi-Fi access points, 21.3.0 up to and including 21.3.0M-13
- Arista Wi-Fi access points, 1.0.0 before 21.3.0 (per the CVE record; default configuration unaffected)
- Only if captive portal or application firewall is enabled on at least one SSID
Fixed in
- 22.1.1F-61 and later (22.x train)
- 21.4.0M-12 and later (21.x train)
- Fixed release for the 1.x to 21.3.0 branch: Unknown.
Workaround
- If captive portal and application firewall are not required, disable both features on all SSIDs. The vendor states this eliminates exposure.
- If the captive portal is needed, no vendor workaround is known. Patching is the remedy.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
- No public proof of concept found. Discovered internally by Arista.
Our recommendation
- Inventory Arista access points and their firmware versions.
- Check which SSIDs use the captive portal or application firewall, and disable both where they are not needed.
- Where they are needed, plan an upgrade to a fixed release. Confirm the fixed version for your branch with Arista first.
- Monitor for crashes or repeated restarts of the wireless gateway service.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0193 www.arista.com
- CVE record (CVEProject cvelistV5) raw.githubusercontent.com
- OpenCVE CVE-2026-102162 app.opencve.io
- Vulners ARISTA:0193 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:13.
Original description (NVD)
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.