Description
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
Published: 2026-10-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The vulnerability exists on Arista Wi‑Fi access points with the Captive Portal feature enabled. An unauthenticated wireless client can send a specially crafted HTTP request that causes the captive‑portal service to crash. The service restarts automatically, but repeated low‑rate requests can keep the portal unavailable, resulting in a persistent denial of service. No remote code execution or data theft is possible based on the provided information.

Affected Systems

Affected products are Arista Networks Wi‑Fi Access Points running firmware in the 22.x train at version 22.1.1F‑61 or newer, or firmware in the 21.x train at version 21.4.0M‑12 or newer. The issue appears on any SSID that has an enabled Captive Portal.

Risk and Exploitability

The CVSS score is 7.1, indicating a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported yet. The attack likely requires wireless access to a captive‑portal SSID, where the attacker sends crafted HTTP requests to trigger the crash. A sustained low‑rate attack can exhaust the portal service, causing an ongoing denial of service for all users of that SSID.

Generated by OpenCVE AI on October 6, 2026 at 23:22 UTC.

Remediation

Vendor Solution

CVE-2026-102169 has been fixed in the following releases: - 22.1.1F-61 and later release in the 22.x train - 21.4.0M-12 and later releases in the 21.x train

Vendor Workaround

If Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available.

OpenCVE Recommended Actions

  • Apply the firmware update to at least version 22.1.1F‑61 in the 22.x train or 21.4.0M‑12 in the 21.x train to patch the null pointer dereference flaw.
  • If Captive Portal is not required for your network, disable Captive Portal on all SSIDs to eliminate the vulnerability.
  • Monitor captive‑portal service logs for restarts or crashes, and consider segmenting Wi‑Fi networks to limit attacker impact if a patch cannot be applied immediately.

Generated by OpenCVE AI on October 6, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Arista
Arista wi-fi Access Points
Vendors & Products Arista
Arista wi-fi Access Points

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
Title Security Advisory 0194
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Arista Wi-fi Access Points
cve-icon MITRE

Status: PUBLISHED

Assigner: Arista

Published:

Updated: 2026-10-06T20:07:05.528Z

Reserved: 2026-09-28T17:45:17.723Z

Link: CVE-2026-102169

cve-icon Vulnrichment

Updated: 2026-10-06T20:07:00.828Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T20:17:12.197

Modified: 2026-10-07T13:38:48.657

Link: CVE-2026-102169

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:32:19Z

Weaknesses