CVE-2026-102164
Executive Summary
CVE-2026-102164 is an out-of-bounds read / memory disclosure affecting Arista access points that are configured with VXLAN tunnelling and L2-proxy — a configuration unique to the VESPA use-case. A wireless client associated to the tunnelled SSID can send a crafted packet that causes the access point to leak memory contents into network traffic, resulting in limited confidentiality loss (CVSS 3.1). No write primitive, remote code execution, or integrity/availability impact is possible, but exposed memory may contain sensitive data such as credentials, keys, or session material.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
The vulnerability is classified as CWE-125 (Out-of-bounds Read). The affected product is an Arista wireless access point operating in a specific deployment mode: VXLAN tunnelling combined with L2-proxy, which the NVD description identifies as a configuration unique to the VESPA use-case. In this mode, the access point forwards wireless client traffic into a VXLAN overlay while performing L2 proxying.
The CNA title field is empty and the NVD description is sparse with respect to code-level detail. The core mechanism, as stated authoritatively in the description, is as follows: a wireless client that is associated to the tunnelled SSID can send a crafted packet, and in response the access point emits memory contents into network traffic. This is a disclosure condition — the device reads beyond an intended buffer boundary and reflects those bytes into egress traffic. The description explicitly states "No write primitive or remote code execution is possible," which constrains the impact to information disclosure only.
Because the NVD description does not name the affected protocol handler, parser function, or packet field, no specific function names, API parameters, or file paths can be provided. The vulnerability class (out-of-bounds read reachable from the wireless data plane over a tunnelled SSID) is the correct level of abstraction supported by the available evidence. The attack surface requires: (1) physical/radio proximity sufficient to associate with the SSID (AV:A, Adjacent Network), (2) a client authenticating to the tunnelled SSID, and (3) the AP being configured with both VXLAN tunnelling and L2-proxy. The AC:H rating reflects that only a subset of deployments matches this configuration and that a specific crafted packet is required.
The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N indicates the attacker requires adjacency, no privileges, and no user interaction, but the difficulty of crafting the packet and the narrow configuration window reduce exploitability. Confidentiality impact is Low because the read is bounded by what memory the disclosure path reaches, not an arbitrary-address primitive.
Exploitation Scenarios
No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-102164. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no implementation-specific details are fabricated.
Reconnaissance / target identification. The adversary identifies an Arista wireless access point deployment that uses VXLAN tunnelling with L2-proxy (the VESPA configuration). This is determined by observing the wireless environment, identifying the tunnelled SSID, and confirming the deployment model. A wireless client capable of associating to that SSID is required.
Triggering the flaw class. The adversary associates to the tunnelled SSID as a normal wireless client (PR:N — no privileges required; UI:N — no user interaction). The adversary then transmits a crafted packet designed to induce the access point to read beyond an intended buffer in the data-plane handling path. This is the CWE-125 out-of-bounds read condition: the packet causes the parser/handler to return or forward memory outside the intended bounds.
Disclosure / execution method. Successful triggering causes the access point to place the out-of-bounds memory contents into network traffic — i.e., the device leaks its own memory into frames or packets observable on the network. The attacker's method is observation of that egress traffic. There is no payload execution: the description explicitly rules out a write primitive and remote code execution.
Post-exploitation impact. Because only a read/disclosure is possible, post-exploitation is limited to analysis of leaked memory. If the leaked region contains sensitive material (for example, data resident in the AP's memory), the adversary gains a Low-confidentiality advantage that could support follow-on targeting. There is no lateral movement, persistence, or code execution derived directly from this CVE.
Impact Assessment
Business impact is bounded: confidentiality only, rated Low (C:L), with no integrity or availability effect (I:N/A:N). The blast radius is limited to Arista access points that are simultaneously configured for VXLAN tunnelling and L2-proxy (VESPA). Organizations not using that configuration are not affected by the described mechanism. Because a wireless client must be present and associated, risk is concentrated in physically accessible radio coverage areas. The absence of a write primitive and RCE meaningfully reduces severity, but leaked memory can still expose confidential data to an attacker on the adjacent wireless network. CVSS base score is 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Detection Guidance
Sigma Rule
title: Arista AP VXLAN/L2-Proxy Wireless Client Memory Disclosure Attempt id: 3f9c1a7e-2b64-4d18-9c0a-7e1b5d2a6f30 status: experimental description: Detects crafted wireless packet activity against Arista access points configured with VXLAN tunnelling and L2-proxy (VESPA) that may trigger CWE-125 memory disclosure (CVE-2026-102164). references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-102164
author: valtersit.com
date: 2026/01/01
logsource:
category: network
product: arista
detection:
selection:
vendor_product: 'Arista'
config_feature:
- 'vxlan'
- 'l2-proxy' event_type:
- 'wireless_client_traffic'
- 'dataplane_anomaly' condition: selection falsepositives:
- Legitimate wireless client traffic in VESPA deployments level: low
YARA Rule
rule CVE_2026_102164_Arista_AP_Memory_Disclosure
{
meta:
description = "Heuristic detection of artifacts relating to CVE-2026-102164 Arista AP VXLAN/L2-proxy out-of-bounds read memory disclosure"
cve = "CVE-2026-102164"
cwe = "CWE-125"
author = "valtersit.com"
date = "2026-01-01"
strings:
$vxlan = "vxlan" ascii nocase
$l2proxy = "l2-proxy" ascii nocase
$vespa = "VESPA" ascii
$aristacve = "CVE-2026-102164" ascii
condition:
($aristacve) or (2 of ($vxlan, $l2proxy, $vespa))
}
Suricata IDS Rule
alert udp any any -> any 4789 (msg:"CVE-2026-102164 Arista AP VXLAN/L2-proxy crafted packet memory disclosure attempt"; flow:to_server; byte_test:1,>,0,0; classtype:attempted-recon; reference:cve,2026-102164; sid:2026102164; rev:1;)
Note: UDP/4789 is the standard VXLAN port and is used here to scope the detection to the affected tunnelling path. The rule is heuristic; no packet-level bytes are specified in the NVD description, so the match condition is intentionally broad and must be tuned.
Elastic Detection
sequence by source.ip with maxspan=5m [ network where network.transport == "udp" and destination.port == 4789 and network.direction == "inbound" ] [ network where event.category == "network" and network.protocol == "vxlan" and rule.name : "wireless_client_dataplane_anomaly" ]
Splunk SPL Query
index=network sourcetype=arista:ap OR sourcetype=suricata | search (dest_port=4789 OR proto=udp) | search (signature="CVE-2026-102164" OR msg="VXLAN" OR msg="l2-proxy") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip signature | where count > 0 | sort - count
Wazuh OSSEC Rule
json Arista vxlan_l2proxy CVE-2026-102164: Possible crafted wireless packet memory disclosure attempt against Arista AP (VXLAN/L2-proxy VESPA config). T1557Mitigation & Patch Guidance
Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently documented in the available data.
- Immediate mitigations. Disable or avoid the VXLAN tunnelling plus L2-proxy (VESPA) configuration where it is not operationally required — the vulnerability is specific to that combined configuration. Restrict wireless association to the tunnelled SSID to trusted clients through strong authentication and MAC/identity controls. Where feasible, reduce the attack surface by segmenting the tunnelled SSID and monitoring egress traffic from access points for unexpected memory-like content. Consult Arista support for interim guidance.
- Patch/upgrade steps. No patch is available from tracked sources. Monitor Arista security advisories and the NVD entry for CVE-2026-102164; apply the vendor-released fixed firmware as soon as it is published. Until then, treat affected APs as unpatched.
- Long-term hardening. Architecturally minimize use of L2-proxy over VXLAN unless required by the VESPA use-case. Implement continuous firmware vulnerability management for wireless infrastructure, enforce wireless intrusion detection to identify anomalous client traffic, and monitor for abnormal egress from access points that could indicate memory disclosure.
References
- NVD — CVE-2026-102164: https://nvd.nist.gov/vuln/detail/CVE-2026-102164
- Arista Security Advisories portal (monitor for a published advisory referencing CVE-2026-102164): https://www.arista.com/en/support/advisories-notices
- CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102164 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- FIRST EPSS (score not yet assigned for this CVE): https://www.first.org/epss/
No threat actor campaigns or exploit-in-the-wild evidence have been observed or reported for CVE-2026-102164 at the time of writing.
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.