CVE-2026-102167

Executive Summary

CVE-2026-102167 is a memory corruption vulnerability (CWE-121, stack-based buffer overflow class) affecting the wired uplink network endpoints of Arista Wi-Fi access points. An unauthenticated attacker positioned on the same network segment as the access point's wired uplink can trigger a crash of the sensor service or potentially achieve remote code execution. With a CVSS base score of 7.5 (High) and no patch, no public PoC, and no CISA KEV listing, the immediate risk is highest for organizations with Arista Wi-Fi deployments where the wired uplink segment is reachable by untrusted or semi-trusted hosts.

Technical Analysis

The vulnerability resides in the processing of network traffic on the wired uplink interface of the affected Arista Wi-Fi access points. Per the NVD description, the flaw is a memory corruption condition within "access point's wired uplink network endpoints." The assigned CWE is CWE-121 (Stack-based Buffer Overflow), indicating that an input of excessive or malformed length is copied into a fixed-size stack buffer without adequate bounds enforcement, corrupting adjacent stack memory.

The CVSS vector — AV:A (Adjacent), AC:H (High), PR:N (None), UI:N (None), S:U (Unchanged), C:H/I:H/A:H — carries several important implications:

• AV:A confirms the attack cannot be launched from a routed/internet position; the adversary must already occupy the same Layer 2 broadcast domain or directly adjacent segment as the access point's wired uplink.
• PR:N confirms no authentication or valid credentials are required, making the entry barrier purely positional rather than credential-based.
• AC:H indicates that successful exploitation is not trivial — reliability of triggering the crash or achieving code execution likely depends on specific packet timing, structure, or ASLR/stack layout conditions.
• C/H/I/A all High means a fully successful exploit yields total loss of confidentiality, integrity, and availability on the affected device, consistent with code execution in the context of the sensor service.

Because CWE-121 concerns memory corruption rather than logic or configuration flaws, the attack surface is the raw packet-processing path of the wired uplink. The service that handles wired-uplink traffic ("sensor service" per the description) is the likely fault domain, and the overflow is triggered by maliciously crafted network input rather than by any authenticated API call.

The description does not disclose the specific function, protocol parser, or field that overflows. No function names, endpoint paths, or parameter names are provided in the source data, and none should be assumed. What can be stated with confidence is the vulnerability class and its boundary condition: a length or content check is missing or insufficient in the wired-uplink receive path, allowing attacker-controlled data to overwrite stack memory.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-102167. The attack chain below is inferred strictly from the vulnerability class (CWE-121) and the described attack surface and is presented at the class level.

1. Reconnaissance / Target Identification — The attacker must first gain presence on the same network segment as an affected access point's wired uplink. This could be achieved by compromising a host on the wired LAN, gaining physical access to an unused switch port, or leveraging a rogue device on the segment. The attacker then identifies Arista Wi-Fi access points by observing management traffic, LLDP/CDP advertisements, or device fingerprinting.

2. Triggering the Flaw Class — Having reached the wired uplink segment, the attacker sends crafted network traffic to the access point's wired-uplink endpoint. Because the flaw is a stack-based buffer overflow, the malicious input supplies data exceeding the bounds of a fixed-size buffer in the packet-handling code path. No authentication is required (PR:N). Under AC:H, the attacker may need to iterate on packet size, structure, or timing to reliably corrupt memory.

3. Payload / Execution Mechanism — At the vulnerability-class level, a stack overflow permits overwriting adjacent stack memory, which can lead to control-flow hijacking if return addresses or function pointers are corrupted. A successful outcome can range from a straightforward denial of service (crash of the sensor service) to remote code execution. The description explicitly states both outcomes are possible. Specific gadgets, ROP chains, or shellcode are attacker-dependent and are not described in the available data.

4. Post-Exploitation Impact — A crash of the sensor service degrades monitoring/availability. If RCE is achieved, the attacker would operate in the context of the sensor service, potentially pivoting into the access point's management plane or using the AP as a foothold on the wired network. Given S:U (scope unchanged), impact is contained to the vulnerable component's security authority.

Impact Assessment

Affected systems are Arista Wi-Fi access points with wired uplink interfaces. The blast radius is bounded by the adjacency requirement — only attackers able to reach the wired uplink segment can attempt exploitation. However, within that segment, the impact is severe: CVSS confidentiality, integrity, and availability are all High. A successful exploit can silently disable the sensor service (availability loss, and a potential monitoring blind spot) or establish code execution on the AP. Organizations operating Arista Wi-Fi in shared or low-trust wired environments (branch offices, retail, education, co-working sites) face the greatest exposure. Because no patch exists and no workaround is documented, risk cannot currently be reduced by remediation — only by network segmentation.

Detection Guidance

Sigma Rule

title: Potential Stack Buffer Overflow Against Arista Wi-Fi AP Wired Uplink
id: 8f3b2c1e-1021-67a4-9c3d-arista2026cve
status: experimental
description: Detects anomalous network-input handling events on Arista Wi-Fi access points consistent with memory corruption attempts.
logsource:
  category: ids
  product: suricata
detection:
  selection_msg:
    alert.signature|contains:
      - 'Arista'
      - 'uplink'
  selection_condition:
    alert.severity: 1
  condition: selection_msg and selection_condition
falsepositives:
  - Legitimate malformed traffic from misconfigured devices
level: high
tags:
  - attack.t1190
  - cve.2026.102167

YARA Rule

rule CVE_2026_102167_Arista_Uplink_MemoryCorruption
{
    meta:
        description = "Detects payloads targeting stack-based memory corruption in Arista Wi-Fi AP wired uplink endpoint"
        author = "Threat Intelligence"
        cve = "CVE-2026-102167"
        cwe = "CWE-121"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102167"
        date = "2026-01-01"

    strings:
        $a = "Arista" ascii nocase
        $b = { 41 72 69 73 74 61 }
        $r = { 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 }

    condition:
        uint16(0) == 0x5a4d or $a or ($b and $r)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"Potential CVE-2026-102167 Arista Wi-Fi AP Wired Uplink Memory Corruption Attempt"; flow:to_server; content:"|41 72 69 73 74 61|"; nocase; depth:200; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:2026102167; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-102167, affected_product Arista_WiFi_AP;)

Note: Because the specific overflow-triggering byte pattern is not disclosed in the source data, this rule keys on high-frequency Arista-referencing traffic to the AP and relies on frequency thresholds; it should be tuned with environment-specific baselines.

Elastic Detection

network where
  network.direction == "inbound" and
  destination.ip != null and
  not source.ip == null and
  (
    process.name == "sensor" or
    network.protocol == "ethernet"
  )

Recommend supplementing with a threshold rule in Elastic Security that fires when a single source IP generates a high rate of malformed or oversized frames toward an Arista Wi-Fi AP management/ uplink MAC address — the crash signature of a stack overflow is typically repeated, closely timed anomalous frames.

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=zeek
| search (dest_oui="ARISTA" OR alert_signature="*Arista*" OR msg="*uplink*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as src_ips
        by dest_ip, alert_signature
| where count > 20
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="arista,cve-2026-102167,">
  <rule id="1021670" level="12">
    <decoded_as>syslog</decoded_as>
    <match>Arista|uplink|coredump|sensor service</match>
    <description>CVE-2026-102167: Possible memory corruption on Arista Wi-Fi AP wired uplink (sensor service crash or RCE attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102167,attack,</group>
  </rule>
  <rule id="1021671" level="10" frequency="5" timeframe="60">
    <if_matched_sid>1021670</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-102167: Repeated memory corruption indicators from same source against Arista AP</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations

   • Segment the wired uplink of Arista Wi-Fi access points onto a dedicated, isolated management VLAN with strict 802.1X or MAC filtering, so that only authorized infrastructure hosts occupy the same Layer 2 domain. The AV:A vector means this single control most directly neutralizes reachable exploitation.
   • Disable unused switch ports in AP-uplink VLANs and enforce port security / storm control to limit a compromised host's ability to flood or craft frames toward the AP.
   • Monitor AP health for unexpected sensor service restarts or crashes, which may indicate opportunistic DoS attempts.

2. Patch / Upgrade Steps

   • Because no vendor fix is currently tracked, monitor Arista security advisories directly for the assignment of a fixed firmware release. When a patch becomes available, prioritize APs in low-trust wired segments and stage upgrades in maintenance windows, watching for the sensor service restart and validating that the wired uplink path is restored.
   • Where feasible, submit a support case with Arista referencing CVE-2026-102167 to obtain interim guidance or a hotfix.

3. Long-Term Hardening

   • Adopt network access control (NAC) and BPDU guard on all AP-facing switch ports to prevent rogue device adjacency.
   • Maintain an inventory of AP firmware baselines and automate CVE matching so future patches for this CVE are applied without delay.
   • Log and alert on all L2 adjacency changes (new MACs, new LLDP neighbors) against AP uplinks.

References

• NVD — CVE-2026-102167: https://nvd.nist.gov/vuln/detail/CVE-2026-102167
• MITRE CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• FIRST EPSS (not yet scored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Arista Security Advisories portal: https://www.arista.com/en/support/advisories-notices
• No public PoC, no Nuclei template, no exploit code, and no confirmed exploit-in-the-wild or threat-actor campaign were identified in the available sources.