The vulnerability is a memory corruption flaw in the wired uplink network endpoints of Arista Wi‑Fi access points. An unauthenticated attacker can cause the sensor service to crash or, in the most severe scenario, gain remote code execution on the affected device. The weakness stems from a stack‑based buffer overflow. This flaw could allow an attacker to compromise the integrity and availability of the access point, potentially exposing or disrupting network traffic managed by the device.

Arista Networks Wi‑Fi Access Points are impacted. The flaw affects firmware versions prior to 22.1.1F‑61 in the 22.x train and prior to 21.4.0M‑12 in the 21.x train. Devices running earlier firmware are therefore vulnerable and should be upgraded to the specified releases or later.

The CVSS score of 9 indicates a high severity risk. The EPSS score is not available, but the lack of authentication required and the local network dependency mean that an internal adversary could exploit the issue during the same segment as the wired uplink. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and the potential for remote code execution make it a critical threat if the access point is not patched promptly. The attack vector is inferred to be a local network segment, requiring the attacker to be physically or logically connected to the access point’s wired uplink.