Arista Wi-Fi Access Points: Out-of-bounds write in WIPS sensor service
Summary
Arista Wi-Fi access points with the Wireless Intrusion Prevention System (WIPS) active contain an out-of-bounds write flaw (CWE-787) in the sensor service, rated 8.7 (CVSS 4.0). An unauthenticated attacker within radio range can send a crafted frame that crashes the sensor service and disables WIPS monitoring, or potentially achieve remote code execution. No wireless association or authentication is required.
Affected
- Arista Wi-Fi access points with WIPS or wireless monitoring active
- 22.0.0 to 22.0.1F-32 (22.x train)
- 21.3.0 to 21.3.0M-13 (21.x train)
- 1.0.0 to before 21.3.0
- Default configuration: unaffected (per CNA record)
- Gap to verify: releases between 22.0.1F-32 and 22.1.1F-61, and between 21.3.0M-13 and 21.4.0M-12, are not clearly classified in the sources reviewed. Check Arista advisory 0195.
Fixed in
- 22.1.1F-61 and later (22.x train)
- 21.4.0M-12 and later (21.x train)
Workaround
- Unknown. The CNA record states that no mitigation or workaround is available.
- Disabling WIPS removes the vulnerable service but also rogue-AP detection. This is a risk decision, not a vendor workaround.
Exploitation
- Arista states the issue was discovered internally and it is not aware of malicious exploitation in customer networks.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof of concept found in limited searches. Not marked as known exploited in the sources reviewed.
Our recommendation
- Inventory Arista access points and identify which run WIPS, including CloudVision CUE-managed deployments.
- Read advisory 0195, confirm the fixed build for each model and resolve the version gap before planning upgrades.
- Patch with medium to high priority, prioritising sites with high foot traffic or neighbouring tenants.
- Monitor for proof-of-concept publications and a CISA KEV listing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0195 (primary) www.arista.com
- OpenCVE: CVE-2026-102163 app.opencve.io
- Arista Security Advisory 0184 (pre-announcement) www.arista.com
- HOL Guard: CVE-2026-102163 advisory 0195 hol.org
- Vulners: Arista ARISTA:0195 vulners.com
- Strix: CVE-2026-102163 www.strix.ai
- OffSeq Radar: CVE-2026-102163 radar.offseq.com
- Arista WIPS product page www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:28.
Original description (NVD)
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.