CVE-2026-102162

Executive Summary

CVE-2026-102162 is a stack-based buffer overflow (CWE-121) in the wireless gateway service of affected Arista Wi-Fi access points. The flaw is exploitable by an unauthenticated, network-adjacent attacker when the affected access point has either a captive portal or application firewall enabled on at least one SSID. A single crafted packet can crash the service, causing a denial-of-service condition, and may permit arbitrary code execution on the device. The weakness carries a CVSS v3.1 base score of 8.8 (High), and no patch, PoC, or exploit code is currently available from tracked sources.

Technical Analysis

CVE-2026-102162 resides in the wireless gateway service of Arista Wi-Fi access points. According to the NVD description, the vulnerability is a stack overflow triggered by processing a crafted packet delivered over an adjacent network path. The affected configuration requires that at least one SSID have either the captive portal feature or the application firewall feature enabled — these features expose the vulnerable code path to untrusted input.

This is a classic memory-safety defect, consistent with CWE-121 (Stack-based Buffer Overflow). Stack overflows occur when a routine copies attacker-controlled data into a fixed-size stack buffer without validating the length of the input. When the copy exceeds the buffer's bounds, adjacent stack memory — typically including the function's saved return address and local variables — is overwritten. This can corrupt control flow and, depending on the layout and protections in place, allow an attacker to redirect execution.

Because the packet is processed by the wireless gateway service prior to authentication, the attacker requires no credentials and no user interaction. The service is network-adjacent reachable — the CVSS vector specifies AV:A (Adjacent Network), meaning the attacker must be within the same broadcast domain or on a reachable wireless network segment. Importantly, the description states the wireless gateway service is automatically restarted after a crash, meaning a denial-of-service condition is observable and the target returns to a vulnerable state quickly, enabling repeated exploitation attempts.

The CVSS vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates low attack complexity, no privileges required, no user interaction, and High impact to confidentiality, integrity, and availability if code execution is achieved. The evaluation of scope as Unchanged (S:U) indicates the vulnerable component and impacted component are assessed as the same security authority.

Insufficient public technical detail is available to identify specific functions, memory offsets, packet field layouts, or the exact copy routine responsible. No specific function names, file paths, or API parameters are disclosed in the NVD description, and none are asserted here.

Exploitation Scenarios

No public PoC or exploit code is available, and the attack chain below is inferred from the vulnerability class and the conditions stated in the NVD description; specific packet field values and offsets are deliberately not fabricated.

1. Reconnaissance and target identification. An attacker positioned on an adjacent network segment (for example, a wireless client associated to the access point, or a host on the same L2 broadcast domain) identifies an Arista access point that has a captive portal or application firewall enabled on at least one SSID. This configuration is the precondition explicitly stated in the NVD description. The attacker determines the reachable network address of the wireless gateway service interface.

2. Triggering the flaw. The attacker crafts a packet directed at the wireless gateway service. Because the defect is a stack overflow, the malicious payload is embedded in one or more fields of that packet whose length is not properly validated before being written to a fixed-size stack buffer. The exact field and structure are not disclosed in available advisory data; the general mechanism — an over-length input causing a stack-based buffer overwrite — is what is known.

3. Execution method. At the class level, exploitation of a stack overflow aims to overwrite the saved return address (or other control data) on the stack so that, when the vulnerable function returns, execution is redirected. This may be used either simply to crash the service (denial-of-service) or, where the stack layout and memory protections permit, to execute attacker-supplied code. The NVD description confirms arbitrary code execution is a potential outcome, stated as "potentially execute arbitrary code."

4. Post-exploitation impact. If only denial-of-service is achieved, the wireless gateway service crashes. Per the description, the service is automatically restarted, so the outage is temporary — but the automatic restart enables repeated exploitation attempts, allowing an attacker to sustain intermittent disruption or to repeatedly attempt code execution under varying inputs. If code execution is achieved, the attacker operates within the context of the wireless gateway service on the access point, potentially exposing configuration data and enabling further compromise of the device and the network it serves.

Impact Assessment

The CVSS v3.1 base score is 8.8 (High) with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practical terms:

• Attack Vector (Adjacent, AV:A): The attacker must be on a logically adjacent network, such as an associated wireless client or a co-located L2 segment. This is a meaningful barrier, but in wireless deployments adjacent access is common (guest networks, shared venues, partner access).
• Attack Complexity (Low, AC:L) and Privileges (None, PR:N): No specialized conditions or credentials are required; the flaw is reachable pre-authentication.
• User Interaction (None, UI:N): No victim action is required.
• Confidentiality / Integrity / Availability (all High): If arbitrary code execution is achieved, the confidentiality of device configuration and data, the integrity of device behavior, and the availability of the service are all affected. At minimum, availability is reliably impacted via the crash.

Blast radius: Every reachable Arista Wi-Fi access point that has a captive portal or application firewall enabled on at least one SSID is potentially affected. Because the wireless gateway service sits in the traffic path for wireless clients, repeated crashes can degrade or interrupt connectivity for all clients relying on that access point. The automatic restart behavior limits but does not eliminate the denial-of-service window and lowers the cost of repeated exploitation attempts.

Business impact: For organizations deploying Arista Wi-Fi as part of their network edge, this is an availability risk for wireless connectivity and a potential foothold on the wireless infrastructure layer. In regulated or high-availability environments, even intermittent wireless gateway crashes can disrupt operations, guest access, and Wi-Fi-based access control. The absence of a patch raises the remediation burden.

Detection Guidance

Sigma Rule

title: Potential Exploitation of Arista Wireless Gateway Stack Overflow (CVE-2026-102162)
id: 4b1c9f2e-7a3d-4e8b-9c6f-2d5a1e7b8c90
status: experimental
description: Detects network-adjacent exploitation attempts against Arista Wi-Fi access points exhibiting process crash and automatic restart patterns associated with the wireless gateway service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102162
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_crash:
    Image|endswith:
      - 'wireless-gateway'
      - 'wgd'
  selection_restart:
    CommandLine|contains:
      - 'restart'
  condition: selection_crash or selection_restart
falsepositives:
  - Legitimate service restarts during maintenance
  - Expected process cycling during firmware upgrade
level: high

YARA Rule

rule CVE_2026_102162_Arista_Wireless_Gateway_StackOverflow
{
    meta:
        author = "valtersit.com"
        description = "Detects malformed over-length packet payloads targeting Arista wireless gateway service (CVE-2026-102162). Heuristic stack-overflow indicator."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102162"
        date = "2026-01-01"
        severity = "high"

    strings:
        // Heuristic: dense repeated byte patterns typical of overflow padding
        $pad_a = { 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 }
        $pad_b = { 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 }
        $pad_c = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

    condition:
        uint16(0) == 0x0800 and
        (any of ($pad_a, $pad_b, $pad_c)) and
        filesize < 65535
}

Suricata IDS Rule

alert udp any any -> any 67 (msg:"CVE-2026-102162 Arista Wireless Gateway potential stack overflow oversized payload"; flow:stateless; dsize:>1400; content:"|41 41 41 41 41 41 41 41|"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-102162; sid:2026102162; rev:1;)

Note: The exact UDP/TCP port and payload field of the wireless gateway service are not disclosed; the rule above is a heuristic template and must be tuned to observed traffic on the affected deployment.

Elastic Detection

sequence by host.name with maxspan=2m
  [ process where process.name : "wireless-gateway*" and event.action == "crashed" ]
  [ process where process.name : "wireless-gateway*" and event.action == "started" ]

This sequence detects the crash-then-automatic-restart pattern described in the advisory, indicating repeated crash-loop behavior consistent with exploitation attempts.

Splunk SPL Query

index=network_device_logs sourcetype="arista:wifi"
(wireless_gateway OR "wireless gateway") ("crash" OR "restart" OR "core dump" OR "stack" OR "segfault")
| stats count values(message) as messages by host, src_ip
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="arista,cve-2026-102162,">
  <rule id="100162" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">wireless-gateway</field>
    <match>crash|restart|segfault|stack overflow</match>
    <description>CVE-2026-102162: Arista wireless gateway service crash/restart detected - possible stack overflow exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or fixed version has been identified. The following guidance is defensive and does not assume a vendor patch.

1. Immediate mitigations:

• Disable the captive portal and application firewall features on any SSID where they are not strictly required. The NVD description confirms these features are the exposure precondition, so removing them eliminates the attack surface for this flaw.
• Where these features are required, restrict wireless client isolation and network-adjacent reachability to the wireless gateway service as tightly as deployment permits.
• Monitor for crash/restart loops of the wireless gateway service (see detection rules) and treat repeated occurrences as a likely exploitation signal.
• Segment guest and untrusted wireless traffic away from management interfaces and other access point services.

2. Patch/upgrade steps:

• No patch is available. Monitor Arista security advisories and the NVD entry for CVE-2026-102162 for an official fix and affected-version notices.
• When a fix is released, inventory all Arista Wi-Fi access points with captive portal or application firewall enabled, then prioritize upgrade of externally reachable and guest-serving units first.
• Until then, treat all affected access points as unpatched.

3. Long-term hardening:

• Enable exploit mitigations supported by the platform (ASLR, stack canaries, non-executable stack) where available, though these do not substitute for a patch.
• Reduce wireless attack surface by minimizing enabled features to the operational minimum.
• Establish continuous monitoring of wireless infrastructure service health to detect silent crash/restart loops.
• Maintain a firmware/vulnerability tracking process and subscribe to Arista security bulletins.

References

• NVD — CVE-2026-102162: https://nvd.nist.gov/vuln/detail/CVE-2026-102162
• MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — (not yet scored as of this report): https://www.first.org/epss/
• Arista Security Advisories portal (monitor for vendor guidance): https://www.arista.com/en/support/advisories-notices
• CISA KEV Catalog — CVE-2026-102162 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or evidence of active in-the-wild exploitation or named threat-actor campaign is available for CVE-2026-102162 at the time of this report.