Low severity · published Oct 6, 2026
CVE-2026-102164
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a cr
3.1
CVSS
0.2%
EPSS
No
On KEV
Description
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wi-Fi Access Points · Arista Networks
22.0.0 through 22.0.1F-32; 21.3.0 through 21.3.0M-13; 1.0.0 before 21.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102164
vendor-advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/24812-security-advisory-0196
More from Wi-Fi Access Points
8.8
CVE-2026-102163
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor
8.8
CVE-2026-102162
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network
7.5
CVE-2026-102165
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote cod
7.5
CVE-2026-102167
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints
6.5
CVE-2026-102169
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP reque