CVE-2026-102167

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102167", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-09-28T17:45:17.723Z", "datePublished": "2026-10-06T19:40:32.432Z", "dateUpdated": "2026-10-06T20:00:36.697Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:40:32.432Z"}, "title": "Security Advisory 0197", "descriptions": [{"lang": "en", "value": "On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.</p>"}]}], "affected": [{"vendor": "Arista Networks", "product": "Wi-Fi Access Points", "platforms": ["Wi-Fi Access Points"], "defaultStatus": "unaffected", "versions": [{"version": "22.0.0", "lessThanOrEqual": "22.0.1F-32", "status": "affected", "versionType": "custom"}, {"version": "21.3.0", "lessThanOrEqual": "21.3.0M-13", "status": "affected", "versionType": "custom"}, {"version": "1.0.0", "lessThan": "21.3.0", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "baseScore": 9, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "configurations": [{"lang": "en", "value": "No specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point's wired uplink network.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>No specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point's wired uplink network.</p>"}]}], "workarounds": [{"lang": "en", "value": "There is no mitigation or workaround available.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>There is no mitigation or workaround available.</p>"}]}], "solutions": [{"lang": "en", "value": "CVE-2026-102167 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>CVE-2026-102167 has been fixed in the following releases:</p><ul><li>22.1.1F-61 and later release in the 22.x train</li><li>21.4.0M-12 and later releases in the 21.x train</li></ul>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197", "tags": ["vendor-advisory"]}], "source": {"advisory": "Security Advisory 0197", "discovery": "INTERNAL", "defects": ["BUG 1846909"]}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T20:00:24.458435Z", "id": "CVE-2026-102167", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T20:00:36.697Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-06T20:00:24.458435Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T20:00:31.409Z"}}], "cna": {"title": "Security Advisory 0197", "source": {"defects": ["BUG 1846909"], "advisory": "Security Advisory 0197", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "Wi-Fi Access Points", "versions": [{"status": "affected", "version": "22.0.0", "versionType": "custom", "lessThanOrEqual": "22.0.1F-32"}, {"status": "affected", "version": "21.3.0", "versionType": "custom", "lessThanOrEqual": "21.3.0M-13"}, {"status": "affected", "version": "1.0.0", "lessThan": "21.3.0", "versionType": "custom"}], "platforms": ["Wi-Fi Access Points"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "CVE-2026-102167 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train", "supportingMedia": [{"type": "text/html", "value": "<p>CVE-2026-102167 has been fixed in the following releases:</p><ul><li>22.1.1F-61 and later release in the 22.x train</li><li>21.4.0M-12 and later releases in the 21.x train</li></ul>", "base64": false}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "There is no mitigation or workaround available.", "supportingMedia": [{"type": "text/html", "value": "<p>There is no mitigation or workaround available.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.", "supportingMedia": [{"type": "text/html", "value": "<p>On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "configurations": [{"lang": "en", "value": "No specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point's wired uplink network.", "supportingMedia": [{"type": "text/html", "value": "<p>No specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point's wired uplink network.</p>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-10-06T19:40:32.432Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102167", "state": "PUBLISHED", "dateUpdated": "2026-10-06T20:00:36.697Z", "dateReserved": "2026-09-28T17:45:17.723Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2026-10-06T19:40:32.432Z", "assignerShortName": "Arista"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Wi-Fi Access Points"], "product": "Wi-Fi Access Points", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "22.0.1F-32", "status": "affected", "version": "22.0.0", "versionType": "custom"}, {"lessThanOrEqual": "21.3.0M-13", "status": "affected", "version": "21.3.0", "versionType": "custom"}, {"lessThan": "21.3.0", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink."}], "id": "CVE-2026-102167", "lastModified": "2026-10-07T13:38:48.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102167", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T20:00:24.458435Z", "version": "2.0.3"}}]}, "published": "2026-10-06T20:17:11.937", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["wi-fi_access_points"], "status": "affected", "versions": {"scheme": "generic", "value": "[22.0.0,22.0.1F-32]"}}, {"platform": ["wi-fi_access_points"], "status": "affected", "versions": {"scheme": "generic", "value": "[21.3.0,21.3.0M-13]"}}, {"platform": ["wi-fi_access_points"], "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0,21.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Wi-Fi Access Points", "source": "cna", "vendor": "Arista Networks"}, "product": "wi-fi_access_points", "vendor": "arista"}], "created": "2026-10-06T23:30:08.284656+00:00", "title": "Memory Corruption in Wired Uplink Endpoints of Arista Wi\u2011Fi Access Points", "updated": "2026-10-09T08:32:12.889292+00:00", "vendors": ["arista", "arista$PRODUCT$wi-fi_access_points"]}