Arista C-250/C-260 access points: Static cryptographic keys for firmware verification
Summary
Arista C-250 and C-260 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who obtains these keys could create modified firmware that passes verification checks. The issue is specific to the C-250 and C-260 models; other access point models enforce signed upgrade images with secure boot.
Affected
- Arista C-250 and C-260 access points
- Affected range per CVE record: 1.0.0 to < * (default: affected); not verified against the vendor advisory
- Other Arista access point models are not affected according to the CVE description
Fixed in
Unknown.
Workaround
- Disable the HMAC-based firmware verification fallback (upgrade_hmac_fallback_enabled = 0) on the management server, as described in the CVE record, then restart the sserverd service
- For cloud deployments, contact Arista TAC
- Keep the access point management interface off user networks and restrict firmware upload rights (general practice, not confirmed by the vendor)
Exploitation
Unknown. No reports of exploitation in the wild or public proof of concept were found.
Our recommendation
- Open Arista Security Advisory 0227 and confirm affected and fixed versions before acting
- Inventory any C-250 or C-260 access points and record their firmware versions
- Apply the vendor's workaround or fix as soon as it is confirmed, and ask Arista support about key rotation or a patch
- Restrict access to the management plane and monitor firmware upload activity
- Consider replacing the devices if no fix is available
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0227 (cited by CVE record, not retrieved) www.arista.com
- Arista Security Advisory 0080 (11ax Wi-Fi 6 access point series) www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:22.
Original description (NVD)
Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.