# CVE-2026-102162: Arista Wi-Fi Access Point stack overflow in wireless gateway service

Source: https://junglewise.ai/threats/cve-2026-102162-on-affected-arista-wi-fi-access-points-with-captive-portal-or  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-102162 · Severity: high · CVSS 8.8 · Published 2026-10-06

Arista Wi-Fi access points with captive portal or application firewall enabled are vulnerable to a stack overflow in the wireless gateway service. An attacker on the network can send a crafted packet to trigger a denial-of-service or execute arbitrary code on the device. The service automatically restarts after crashing, enabling repeated attack attempts.

Technologies: [Arista Wi-Fi Access Point](https://junglewise.ai/threats/technologies/wi-fi-access-point). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-102162 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102162 being exploited in the wild.

**How severe is CVE-2026-102162?** High severity, with a CVSS score of 8.8, published 6 October 2026.

**Which products and versions are affected?** Arista Wi-Fi Access Point 22.0.1F-32 and below (22.x train), 21.3.0M-13 and below (21.x train), and all prior releases.

**Is there a fix for CVE-2026-102162?** Yes: fixed in 22.1.1F-61 and later (22.x train), 21.4.0M-12 and later (21.x train). Until then: Disable captive portal and application firewall on all SSIDs if these features are not required; this eliminates exposure to the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102162 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-102162?** Check whether you run Arista Wi-Fi Access Point at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 22.1.1F-61 and later (22.x train), 21.4.0M-12 and later (21.x train)

Disable captive portal and application firewall on all SSIDs if these features are not required; this eliminates exposure to the vulnerability.

## Technical details

A stack-based buffer overflow (CWE-121) in the wireless gateway service allows unauthenticated, network-adjacent attackers to trigger arbitrary code execution or denial of service by sending a crafted packet. Exploitation requires captive portal or application firewall to be enabled on at least one SSID. The vulnerable service auto-restarts after a crash, facilitating repeated exploitation.

## Affected products

- Arista Wi-Fi Access Point 22.0.1F-32 and below (22.x train), 21.3.0M-13 and below (21.x train), and all prior releases

## Timeline

- 2026-10-06: disclosed

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24809-security-advisory-0193](https://www.arista.com/en/support/advisories-notices/security-advisory/24809-security-advisory-0193)

## Related threats

- [Arista Wi-Fi Access Point denial of service in Captive Portal](https://junglewise.ai/threats/cve-2026-102169-on-affected-arista-wi-fi-access-points-with-captive-portal)
- [Arista Wi-Fi Access Point denial of service in Captive Portal](https://junglewise.ai/threats/cve-2026-102168-on-affected-arista-wi-fi-access-points-with-captive-portal)
- [Arista Wi-Fi Access Point memory corruption in wired uplink](https://junglewise.ai/threats/cve-2026-102167-on-affected-arista-wi-fi-access-points-a-memory-corruption)
- [Arista Wi-Fi Access Point stack-based buffer overflow in capture service](https://junglewise.ai/threats/cve-2026-102165-on-affected-arista-wi-fi-access-points-an-unauthenticated)
- [Arista Wi-Fi Access Point WIPS out-of-bounds write](https://junglewise.ai/threats/cve-2026-102163-on-affected-arista-access-points-with-wireless-intrusion)