The vulnerability is a buffer overflow in the capture service on Arista Wi‑Fi access points. An unauthenticated attacker with network access can send a crafted packet that forces the service to crash; in some circumstances the flaw may allow the attacker to execute arbitrary code. The flaw requires the use of an uncommon, non‑default streaming mode, but once enabled it opens a clear remote execution path.

Affected products are Arista Networks Wi‑Fi access points. The vulnerability is present in the 22.x train starting with release 22.1.1F‑61 and any later releases, and in the 21.x train starting with release 21.4.0M‑12 and any later releases.

The CVSS score of 7.7 indicates a high severity. EPSS data is not available, but the flaw is not listed in CISA KEV, so there is no evidence of active exploitation yet. However, because the attack vector is an unauthenticated network connection to the capture service and the impact is remote code execution, the overall risk remains significant, especially in environments where the non‑default streaming mode is enabled or the service is reachable on the network.