by Kastro
Paper/Archive/CVE-2026-102166

CVE-2026-102166

Arista Networks Wi-Fi Access Point — Security Advisory 0227

CVSS 9.4
critical.is priorityof 100
28
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.

Affected

ProductAffectedFixed inSource
Wi-Fi Access Point1.0.0–CNA

Scores by source

Arista (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Arista (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

advisoryarista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227