An unauthenticated wireless client can send a crafted HTTP request to a captive‑portal‑enabled SSID on affected Arista Wi‑Fi access points. The request causes the captive‑portal service to crash and automatically restart, resulting in a brief denial of service for any clients that rely on the portal. The flaw is an integer arithmetic issue, identified as CWE-191, and it does not allow remote code execution.

Arista Networks Wi‑Fi Access Points with Captive Portal enabled. The issue exists in firmware versions prior to 22.1.1F‑61 and 21.4.0M‑12, i.e., any release in the 22.x train before 22.1.1F‑61 and any release in the 21.x train before 21.4.0M‑12.

The CVSS score of 7.1 indicates moderate severity. EPSS is not available but the lack of a container or remote code execution requirement lowers the likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to connect to the relevant SSID, which is a local wireless access scenario; the impact is a temporary denial of service for portal users until the service restarts.