CVE-2026-102169

Executive Summary

CVE-2026-102169 is a denial-of-service vulnerability affecting Arista Wi-Fi access points with the Captive Portal feature enabled. An unauthenticated wireless client associated to a captive-portal-enabled SSID can send a crafted HTTP request that crashes the captive portal service, which then automatically restarts. Because the attack requires no authentication and can be repeated at low rate, a sustained campaign can produce persistent unavailability of the captive portal for all clients on the affected SSID. Remote code execution is explicitly not possible, limiting the impact to availability (CVSS 6.5, A:H).

Technical Analysis

The vulnerability is classified as CWE-476 (NULL Pointer Dereference). This weakness class occurs when software dereferences a pointer that is NULL, typically producing a crash or abnormal termination of the affected process. In the case of CVE-2026-102169, the affected component is the captive portal service running on Arista Wi-Fi access points.

The attack surface is the captive portal HTTP service, which by design is reachable by any unauthenticated wireless client that has associated to a captive-portal-enabled SSID. Captive portal services are intended to intercept client HTTP requests and redirect them to an authentication or splash page before granting further network access. This means the service accepts unauthenticated HTTP input from any associated client — a broad, low-friction attack surface.

The trigger condition, as described by the CNA, is a "crafted HTTP request" that causes the portal service to crash. The specific request structure, parameter, or header that induces the NULL dereference is not described in the available NVD description or CNA title. The observable symptom is a service crash followed by automatic restart. Sustained, low-rate repetition of the same crafted request can cause a persistent denial of service of the captive portal, suggesting the service either has no effective rate limiting, crash-loop protection, or request-shape filtering.

Key technical constraints established by the description:

• No authentication required (PR:N) — any associated wireless client can trigger it.
• Adjacent network vector (AV:A) — the attacker must be on the wireless segment (associated to the SSID), not remote over the internet.
• No user interaction (UI:N) — the attacker triggers it directly.
• Availability-only impact (C:N/I:N/A:H) — confidentiality and integrity are unaffected.
• No RCE — the vulnerability cannot be chained into code execution.

The precise code path, function, or parsing routine that dereferences the NULL pointer is not specified in the source data. Analysts should treat the request itself as unknown until vendor advisory or PoC detail becomes available. What can be stated with confidence is the vulnerability class: malformed or unexpected HTTP input reaches a code path where an expected pointer was never initialized (or was explicitly nulled), and a dereference follows.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-102169. The attack chain below is described at the vulnerability-class level and is inferred from the NVD description; specific request field names and byte sequences are not available and are not fabricated here.

1. Reconnaissance / target identification

An adversary within physical or RF range of an Arista Wi-Fi deployment identifies a captive-portal-enabled SSID. This is often trivially observable: captive portal SSIDs advertise a splash/authentication flow and redirect unauthenticated clients. The attacker associates a wireless client to the SSID and confirms that a captive portal service is responding.

2. Triggering the flaw class

Once associated, the attacker sends HTTP requests to the captive portal service. The crafted request that triggers CVE-2026-102169 is one that drives the portal service into a NULL pointer dereference. Because the exact request shape is undisclosed, an attacker would either need the undisclosed detail or perform request mutation/fuzzing against the portal endpoint to discover it. The description confirms the successful outcome: the portal service crashes.

3. Payload / execution method

At the vulnerability-class level, this is a malformed-input DoS against an HTTP service. There is no code execution, no shell, and no payload delivery beyond the crafted HTTP request itself. The "payload" is simply the request that causes the NULL dereference. No specific parameter, header, or path can be named from the available data.

4. Post-exploitation impact

The service automatically restarts, so a single request produces only a brief outage. The attacker's leverage is repetition: a sustained low-rate stream of the crafted request can keep the portal service cycling through crash/restart, rendering the captive portal persistently unavailable to legitimate users. This is a pure availability attack. It does not yield credentials, does not expose data, and does not grant network access beyond what the attacker's associated client already has.

Impact Assessment

CVSS v3.1: 6.5 (Medium) — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• AV:A (Adjacent) — the attacker must be on the same wireless segment (associated client), which bounds the attack to actors within radio range of the SSID. This is a meaningful constraint that keeps the score at Medium rather than High.
• AC:L (Low) — no special conditions or race windows are described; the request simply must match the crafted form.
• PR:N (None) — no credentials or prior authorization are required.
• UI:N (None) — no victim user action is needed; the attacker drives the attack directly.
• S:U (Unchanged) — impact is confined to the vulnerable captive portal component; it does not compromise other components.
• C:N / I:N — no confidentiality or integrity impact. No data is read or altered.
• A:H (High) — the captive portal service can be rendered persistently unavailable.

Business impact. Captive portals commonly gate guest, visitor, contractor, and onboarding access in retail, hospitality, healthcare, education, and enterprise environments. Persistent captive portal outage means new clients cannot complete onboarding and cannot reach the network through that SSID. Existing sessions may be unaffected, but any user flow that depends on the portal (guest registration, terms acceptance, credential capture) is broken. For staffed venues this creates help-desk load and lost productivity; for customer-facing venues it can directly disrupt guest connectivity and revenue-bearing services.

Blast radius. The impact is scoped to captive-portal-enabled SSIDs on affected Arista access points. It is not a full AP compromise, not a network-wide takeover, and — per the description — not exploitable for remote code execution. The aggregate severity is driven by how critical the captive portal is to the environment and how easily an attacker can reach it from an adjacent position.

Detection Guidance

Detection focuses on two complementary planes: service-side health signals (crash/restart cycles of the captive portal process) and network-side request patterns (unusually shaped or high-frequency HTTP requests to the captive portal from typically unauthenticated wireless clients). Because no published signature or PoC describes the exact crafted request, the rules below target behavioral correlates — repeated portal process restarts and request-rate anomalies — rather than a specific known malicious string.

Sigma Rule

title: Arista Wi-Fi Captive Portal Service Crash / Restart Loop (CVE-2026-102169)
id: 8f2b1c74-3d9a-4e6f-9a10-cve2026102169
status: experimental
description: >
  Detects repeated crash/restart cycles of the captive portal service on Arista
  Wi-Fi access points, consistent with sustained low-rate exploitation of
  CVE-2026-102169 (CWE-476 NULL pointer dereference via crafted HTTP request).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102169
author: valtersit.com
tags:
  - attack.t1499
  - cve.2026-102169
logsource:
  product: arista
  service: wireless
detection:
  selection_event:
    - EventID: "PORTAL_SERVICE_CRASH"
    - EventID: "PORTAL_RESTART"
    - message|contains:
        - "captive portal"
        - "portal service"
  selection_action:
    message|contains:
      - "restart"
      - "crash"
      - "segfault"
      - "exception"
  timeframe: 5m
  condition: selection_event and selection_action | count() by host > 3
falsepositives:
  - Legitimate software updates or manual service restarts
  - Genuine software fault unrelated to an attack
level: medium

YARA Rule

rule CVE_2026_102169_Arista_CaptivePortal_DoS_Indicators
{
    meta:
        author      = "valtersit.com"
        description = "Heuristic indicators for CVE-2026-102169 (Arista captive portal NULL deref DoS). No public PoC; rule matches on generic crash and portal artifacts only."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-102169"
        cve         = "CVE-2026-102169"
        cwe         = "CWE-476"
        date        = "2026-01-01"
        severity    = "medium"

    strings:
        $portal1 = "captive portal" nocase
        $portal2 = "captive-portal" nocase
        $portal3 = "portal service" nocase
        $crash1  = "segmentation fault" nocase
        $crash2  = "segfault" nocase
        $crash3  = "null pointer" nocase
        $crash4  = "nullptr" nocase
        $vendor  = "arista" nocase

    condition:
        uint32(0) == 0x464C457F and
        $vendor and
        (
            (any of ($portal*)) and (any of ($crash*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102169 Arista Captive Portal Possible DoS - Rapid Repeated Requests from Wireless Client"; flow:to_server,established; http.method; content:"GET"; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-dos; reference:cve,2026-102169; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102169; metadata:affected_product Arista_WiFi_AP, attack_target Networking_Equipment, deployment Perimeter, signature_severity Minor, created_at 2026_01_01, mitre_tactic_id T1499; sid:2026102169; rev:1;)

alert http any any -> any any (msg:"CVE-2026-102169 Arista Captive Portal Anomalous Method Flood"; flow:to_server,established; http.method; content:"POST"; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-dos; reference:cve,2026-102169; sid:2026102170; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and destination.port in (80, 8080, 443) and http.request.method != null ]
  [ network where network.protocol == "http" and destination.port in (80, 8080, 443) and http.request.method != null ]
  [ network where network.protocol == "http" and destination.port in (80, 8080, 443) and http.request.method != null ]

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=pan:traffic OR sourcetype=arista:wireless
| where (dest_port=80 OR dest_port=8080 OR dest_port=443)
| stats count AS http_requests, dc(dest_port) AS ports, values(http_method) AS methods BY src_ip, dest_ip
| where http_requests > 100
| eval anomaly_score = http_requests / 100
| eval cve = "CVE-2026-102169"
| eval note = "High-frequency HTTP requests to captive portal - possible sustained DoS"
| sort - http_requests
| table src_ip, dest_ip, http_requests, methods, anomaly_score, cve, note

Wazuh OSSEC Rule

<group name="arista,captive_portal,denial_of_service,">
  <rule id="2026101" level="0">
    <decoded_as>json</decoded_as>
    <field name="program">captive-portal</field>
    <description>Arista captive portal log event</description>
  </rule>

  <rule id="2026102" level="10" frequency="3" timeframe="300">
    <if_matched_sid>2026101</if_matched_sid>
    <match>restart|crash|segfault|exception</match>
    <same_source_ip />
    <description>CVE-2026-102169: Repeated Arista captive portal service restarts (possible sustained DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,pci_dss_10.6,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor advisory, fixed version, or workaround is available in the provided data. Affected version ranges are not published. Organizations must assume all Arista Wi-Fi access points with Captive Portal enabled may be affected until Arista publishes an advisory.

1) Immediate mitigations (compensating controls)

• Contact Arista TAC for CVE-2026-102169 status and any available hotfix or interim guidance. This is the authoritative path to patch information.
• Disable Captive Portal on SSIDs where it is not strictly required. If the portal is not needed, removing the feature removes the attack surface entirely.
• Reduce the attack surface by limiting which SSIDs run Captive Portal, and restrict RF coverage/signal containment so the SSID is not reachable from outside controlled physical boundaries.
• Apply wireless client isolation and segmentation so that a malicious wireless client has minimal reach; note this does not prevent the portal crash itself, only lateral follow-on activity.
• Monitor the portal service for crash/restart cycles using the detection rules above, and alert on abnormal restart frequency.
• Rate-limit or shape HTTP traffic to the captive portal at the wireless edge where infrastructure permits.

2) Patch / upgrade steps

• No fixed version is identified in the provided data. Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-102169) and Arista's security advisory channels for a fixed firmware release.
• Once a fix is available: inventory all Arista Wi-Fi access points, identify units with Captive Portal enabled, stage the fixed firmware, and schedule an upgrade window. Validate the portal service behavior post-upgrade.
• If Arista confirms a specific affected version range, prioritize internet- or guest-exposed deployments first.

3) Long-term hardening

• Vendor advisory subscription: subscribe to Arista security advisories and CISA notifications to shorten exposure windows.
• Feature minimization: enable Captive Portal only where required, on the minimum set of SSIDs, with the smallest practical RF footprint.
• Fault-tolerance design: ensure the captive portal's crash/restart behavior is rate-limited or supervised so single-request crashes cannot degrade into sustained outages, once vendor capability allows.
• Continuous monitoring: retain the Sigma/YARA/Suricata/Elastic/Splunk/Wazuh detections above in production and tune thresholds to the environment's legitimate portal traffic baseline.
• Incident playbook: define a response for "captive portal repeatedly restarting" that includes wireless-client attribution (which MAC/IP is driving the request volume) and temporary SSID disablement.

References

1. NVD — CVE-2026-102169: https://nvd.nist.gov/vuln/detail/CVE-2026-102169
2. MITRE CWE-476 — NULL Pointer Dereference: https://cwe.mitre.org/data/definitions/476.html
3. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. Arista Networks Security Advisories portal (consult for CVE-2026-102169 advisory/fix): https://www.arista.com/en/support/advisories-notices
5. FIRST EPSS — CVE-2026-102169 (not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-102169

Exploit-in-the-wild / campaign status: No public PoC, exploit code, Nuclei template, or CISA KEV entry is associated with CVE-2026-102169 in the provided data. No known threat actor campaigns are reported. CISA KEV status: NO.