CVE-2026-102165

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102165", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-09-28T17:45:17.722Z", "datePublished": "2026-10-06T19:40:32.909Z", "dateUpdated": "2026-10-06T20:00:05.234Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:40:32.909Z"}, "title": "Security Advisory 0198", "descriptions": [{"lang": "en", "value": "On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.</p>"}]}], "affected": [{"vendor": "Arista Networks", "product": "Wi-Fi Access Points", "platforms": ["Wi-Fi Access Points"], "defaultStatus": "unaffected", "versions": [{"version": "22.0.0", "lessThanOrEqual": "22.0.1F-32", "status": "affected", "versionType": "custom"}, {"version": "21.3.0", "lessThanOrEqual": "21.3.0M-13", "status": "affected", "versionType": "custom"}, {"version": "1.0.0", "lessThan": "21.3.0", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "configurations": [{"lang": "en", "value": "A Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability.</p>"}]}], "workarounds": [{"lang": "en", "value": "When using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\".", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>When using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\".</p>"}]}], "solutions": [{"lang": "en", "value": "CVE-2026-102165 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>CVE-2026-102165 has been fixed in the following releases:</p><ul><li>22.1.1F-61 and later release in the 22.x train</li><li>21.4.0M-12 and later releases in the 21.x train</li></ul>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198", "tags": ["vendor-advisory"]}], "source": {"advisory": "Security Advisory 0198", "discovery": "INTERNAL", "defects": ["BUG 1846910"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T19:59:55.213686Z", "id": "CVE-2026-102165", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T20:00:05.234Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102165", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-06T19:59:55.213686Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T19:59:59.885Z"}}], "cna": {"title": "Security Advisory 0198", "source": {"defects": ["BUG 1846910"], "advisory": "Security Advisory 0198", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "Wi-Fi Access Points", "versions": [{"status": "affected", "version": "22.0.0", "versionType": "custom", "lessThanOrEqual": "22.0.1F-32"}, {"status": "affected", "version": "21.3.0", "versionType": "custom", "lessThanOrEqual": "21.3.0M-13"}, {"status": "affected", "version": "1.0.0", "lessThan": "21.3.0", "versionType": "custom"}], "platforms": ["Wi-Fi Access Points"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "CVE-2026-102165 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train", "supportingMedia": [{"type": "text/html", "value": "<p>CVE-2026-102165 has been fixed in the following releases:</p><ul><li>22.1.1F-61 and later release in the 22.x train</li><li>21.4.0M-12 and later releases in the 21.x train</li></ul>", "base64": false}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "When using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\".", "supportingMedia": [{"type": "text/html", "value": "<p>When using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\".</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.", "supportingMedia": [{"type": "text/html", "value": "<p>On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "configurations": [{"lang": "en", "value": "A Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<p>A Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability.</p>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:40:32.909Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102165", "state": "PUBLISHED", "dateUpdated": "2026-10-06T20:00:05.234Z", "dateReserved": "2026-09-28T17:45:17.722Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2026-10-06T19:40:32.909Z", "assignerShortName": "Arista"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Wi-Fi Access Points"], "product": "Wi-Fi Access Points", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "22.0.1F-32", "status": "affected", "version": "22.0.0", "versionType": "custom"}, {"lessThanOrEqual": "21.3.0M-13", "status": "affected", "version": "21.3.0", "versionType": "custom"}, {"lessThan": "21.3.0", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode."}], "id": "CVE-2026-102165", "lastModified": "2026-10-07T13:38:48.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102165", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T19:59:55.213686Z", "version": "2.0.3"}}]}, "published": "2026-10-06T20:17:11.800", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["wi-fi_access_points"], "status": "affected", "versions": {"scheme": "generic", "value": "[22.0.0,22.0.1F-32]"}}, {"platform": ["wi-fi_access_points"], "status": "affected", "versions": {"scheme": "generic", "value": "[21.3.0,21.3.0M-13]"}}, {"platform": ["wi-fi_access_points"], "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,21.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Wi-Fi Access Points", "source": "cna", "vendor": "Arista Networks"}, "product": "wi-fi_access_points", "vendor": "arista"}], "created": "2026-10-06T23:30:08.284524+00:00", "title": "Unauthenticated Remote Code Execution via Buffer Overflow in Arista Wi\u2011Fi Capture Service", "updated": "2026-10-09T08:32:10.834709+00:00", "vendors": ["arista", "arista$PRODUCT$wi-fi_access_points"]}