CVE-2026-102168

Executive Summary

CVE-2026-102168 is an unauthenticated denial-of-service vulnerability in Arista Wi-Fi access points that have the Captive Portal feature enabled. A wireless client connected to a Captive-Portal-enabled SSID can send a crafted HTTP request that crashes the captive portal service, causing a temporary outage of the portal until the service automatically restarts. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), is remotely triggerable from an adjacent network without privileges or user interaction, and does not permit remote code execution.

Technical Analysis

The affected component is the captive portal service running on Arista Wi-Fi access points when the Captive Portal feature is enabled. The root cause is classified as CWE-191 (Integer Underflow / Wraparound), indicating that the crafted HTTP request causes an integer value to wrap below its minimum valid bound, which the portal service fails to handle safely, leading to a process crash.

The attack surface is the wireless association path combined with the captive portal HTTP interface. Because the portal service is reachable by any wireless client that can associate to a Captive-Portal-enabled SSID, no authentication, credentials, or prior foothold are required — the attacker merely needs to be within wireless radio range (AV:A, adjacent network). The access complexity is Low (AC:L) and exploitation requires no user interaction (UI:N), meaning a single crafted request is sufficient to trigger the fault.

The specific HTTP request structure, the affected input field, and the exact code path within the portal service are not described in the available advisory text beyond the integer underflow classification. No function names, URL paths, or parameter names are provided in the source data, and none should be assumed. The impact is strictly availability-related: the description explicitly states that remote code execution is not possible, so the vulnerability does not expose confidentiality or integrity (C:N/I:N), only availability (A:H). The service restarts automatically, bounding the outage to a temporary window rather than a permanent loss of the portal function.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification: An attacker in wireless range scans for SSIDs configured with Captive Portal and identifies Arista Wi-Fi access points presenting a captive portal. No credentials are required at this stage; association to the open or guest captive-portal SSID is sufficient to reach the portal service.

2. Triggering the flaw class: The attacker connects as an unauthenticated wireless client to the Captive-Portal-enabled SSID and issues a crafted HTTP request to the portal service. The request is constructed to drive an integer value into an underflow/wraparound condition (CWE-191), which the portal service does not validate or bound properly.

3. Execution method (class level): Because the flaw is an integer underflow rather than a memory-corruption code-execution primitive, the outcome is a service fault. The malformed request causes the portal process to crash. There is no shellcode, injection payload, or privilege escalation step — exploitation terminates at causing the crash.

4. Post-exploitation impact: The captive portal service terminates and remains unavailable until it automatically restarts. During the outage window, new wireless clients cannot complete portal authentication/onboarding. The attacker can repeat the request after each restart to sustain the denial of service. No code execution, data access, or lateral movement results from this vulnerability per the advisory.

Impact Assessment

The CVSS v3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, yielding a base score of 6.5. This reflects: attack vector Adjacent Network (wireless proximity required), Low attack complexity, no privileges required, no user interaction, Unchanged scope, and High availability impact with no confidentiality or integrity impact.

Business impact is a localized availability degradation. Affected systems are Arista Wi-Fi access points with Captive Portal enabled. Blast radius is scoped to the captive portal function itself — the advisory does not indicate that the access point's core wireless forwarding or the broader network is taken down, only the portal service, which recovers automatically. The most exposed environments are guest Wi-Fi deployments, hotels, conference venues, cafeterias, and enterprises using captive portals for guest onboarding, where a single nearby client can repeatedly disable the onboarding portal. Because the attacker needs only wireless adjacency and can retrigger the crash, sustained nuisance-level DoS is feasible with low effort. EPSS has not been scored by FIRST.org, CISA KEV does not list this CVE, and no PoC or exploit code has been observed, indicating limited current threat activity.

Detection Guidance

Sigma Rule

title: Arista Captive Portal Service Crash via Crafted HTTP Request (CVE-2026-102168)
id: 7c2f4b9e-1a3d-4e5f-9b8c-2d6a0f7e1c44
status: experimental
description: Detects captive portal service crash/restart events on Arista Wi-Fi access points that may indicate exploitation of CVE-2026-102168 (integer underflow leading to portal DoS).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102168
author: valtersit.com
date: 2026-01-01
logsource:
  product: arista
  service: captive_portal
detection:
  selection_crash:
    event.action|contains:
      - 'portal_service_crash'
      - 'portal_restart'
      - 'captive-portal process terminated'
  selection_signal:
    event.category: 'process'
    event.type: 'end'
    process.name|contains: 'portal'
  condition: selection_crash or selection_signal
falsepositives:
  - Portal service restarts during planned firmware upgrades or maintenance
  - Legitimate service watchdog restarts
level: medium
tags:
  - attack.t1499

YARA Rule

rule CVE_2026_102168_CaptivePortal_Crash_Indicators
{
    meta:
        description = "Detects log or crash-dump artifacts indicating captive portal service termination on Arista Wi-Fi APs related to CVE-2026-102168"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102168"
        date = "2026-01-01"

    strings:
        $c1 = "captive portal" ascii nocase
        $c2 = "captive-portal" ascii nocase
        $c3 = "portal service" ascii nocase
        $c4 = "integer underflow" ascii nocase
        $c5 = "portal crash" ascii nocase
        $c6 = "portal restart" ascii nocase

    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x00000000 or filesize > 0 and
        any of ($c1, $c2, $c3) and any of ($c4, $c5, $c6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102168 Arista Captive Portal Crafted Request DoS Attempt"; flow:to_server,established; http.method; content:"GET"; http.header; content:"Captive"; nocase; reference:cve,2026-102168; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102168; classtype:attempted-dos; sid:2026102168; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where network.protocol == "http" and
      http.request.method in ("GET", "POST") and
      http.host : "*portal*" ]
  [ network where event.category == "process" and
      event.type == "end" and
      process.name : "*portal*" ]

Note: Because the source data does not disclose the exact HTTP path or parameter used, the query keys on captive-portal HTTP traffic immediately preceding a portal process termination on the same source IP.

Splunk SPL Query

index=network (sourcetype=pan:traffic OR sourcetype=suricata OR sourcetype=arista:ap)
(dest_port=80 OR dest_port=443) (uri_path="*portal*" OR http_host="*portal*")
| eval portal_hit=1
| stats count by src_ip, http_host, uri_path
| where count > 20
| sort - count

Complementary query for the portal service crash events:

index=infra sourcetype="arista:ap" event="*portal*" (crash OR restart OR "terminated")
| stats count earliest(_time) latest(_time) by host, src_ip

Wazuh OSSEC Rule

<group name="arista,captive_portal,cve-2026-102168,">
  <rule id="102168" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">portal.*crash|portal.*restart|portal.*terminated</field>
    <description>CVE-2026-102168: Arista captive portal service crash/restart detected - possible crafted HTTP DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is currently documented in the available intelligence. The following guidance is therefore precautionary and should be validated against Arista's official security advisories before acting.

1. Immediate mitigations:

   • Disable the Captive Portal feature on SSIDs where it is not operationally required; doing so removes the exposed attack surface entirely.
   • Restrict the guest SSID and captive portal to the smallest feasible coverage and, where possible, segment guest portal traffic from management and production networks.
   • Monitor for repeated portal service restarts, which may indicate repeat exploitation attempts by a nearby wireless client.
   • Apply wireless intrusion detection/monitoring to flag abnormal clients repeatedly associating and generating malformed portal HTTP traffic.

2. Patch/upgrade steps:

   • Monitor the Arista security advisories and firmware release notes for a fixed access point firmware release addressing CVE-2026-102168.
   • Once a fixed firmware version is published, upgrade all Captive-Portal-enabled access points promptly and verify the portal service version post-upgrade.
   • Re-enable the Captive Portal feature only after remediation is confirmed.

3. Long-term hardening:

   • Maintain an inventory of access points with the Captive Portal feature enabled and include them in routine firmware patch governance.
   • Enforce input validation and bounds checking standards for portal-facing services; treat integer underflow/wraparound as a first-class defect class.
   • Adopt a change-management process that requires captive portal firmware to be kept current and tests captive portal resilience during updates.

References

• NVD — CVE-2026-102168: https://nvd.nist.gov/vuln/detail/CVE-2026-102168
• CWE-191 — Integer Underflow (Wrap or Wraparound): https://cwe.mitre.org/data/definitions/191.html
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS: no score published for CVE-2026-102168 at the time of writing
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-102168 not listed; no exploit-in-the-wild or threat actor campaign evidence currently available
• Arista Security Advisories: consult the vendor portal for a firmware fix and any official advisory (none referenced in the source data provided)