{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 227 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227" } ], "title": "Security Advisory 227", "tracking": { "current_release_date": "2026-11-08T09:58:18Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 227", "initial_release_date": "2026-11-08T09:58:18Z", "revision_history": [ { "date": "2026-11-08T09:58:18Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "WiFi version 1.0.0", "product": { "name": "WiFi version 1.0.0", "product_id": "CSAFPID-0" } } ], "category": "product_name", "name": "WiFi" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-102166", "id": { "system_name": "Arista Bug ID", "text": "1846906" }, "notes": [ { "category": "description", "text": "Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.", "title": "CVE Description" }, { "category": "other", "text": "This vulnerability is specific to the C-260 and C-250 access point models. No specific configuration is required. Other access point models enforce digitally signed firmware upgrades and are not affected.", "title": "1846906: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-0" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102166" } ], "remediations": [ { "category": "none_available", "details": "Not fixed in WiFi version mwm-v1.0.0", "product_ids": [ "CSAFPID-0" ] }, { "category": "mitigation", "details": "To ensure all firmware upgrades undergo mandatory digital signature verification, customers are advised to disable the HMAC-based firmware verification fallback path on affected access points.\n\n### Cloud Management\n\nPlease contact the Arista TAC for assistance in disabling this path.\n\n### On-Prem Deployment\n\nFor On-prem deployments, first identify the active HA node. Apply the change only on the active node.\n\n1. On the active node, enter the Wi-Fi Manager container using nerdctl exec with root access from CVP shell. \n\n`nerdctl exec -it wifimanager -- bash`\n\n2. From inside the container, run the config CLI command `set config parameter` and update the upgrade\\_hmac\\_fallback\\_enabled parameter to 0 for configid 1 and 3.\n3. Restart sserverd after updating the parameter so the change takes effect.\n\n```\n[root@cvml-10-243-248-71 ~]# nerdctl exec -it wifimanager -- bash\n[root@wifi-security-server1 /]# su - config\n[Last login: Tue Nov 3 15:46:35 UTC 2026 from 10.95.66.215 on pts/3\n\nWelcome to the Server Config Shell.\nType \"help\" to list available commands in this shell.\n\nNote: Bash style tabbed command completion, command\nhistory and command line editing are supported by this\nshell. This shell works best when used in full screen\nmode\n\nTo configure backspace, use the 'set erase' command.\n[config]$ set config parameter\nSets a configuration parameter directly in the database. You must know the exact name, ID and value of the database parameter to use this command.\n\nEnter parameter name: upgrade_hmac_fallback_enabled\nEnter parameter value: 0\nEnter configid: 3\n\nCurrent value of parameter [upgrade_hmac_fallback_enabled] is [0]\n\nDo you want to update [upgrade_hmac_fallback_enabled] to [0] in configid [3]? (y/n):y\n[Value of parameter [upgrade_hmac_fallback_enabled] has been updated successfully.\nSkipping Aeris sync for configuration parameter [upgrade_hmac_fallback_enabled] because [FT_TOGGLE_CONFIG_PARAMS_TO_AERIS] is disabled for instance Id: [0].\n[config]$ set config parameter\nSets a configuration parameter directly in the database. You must know the exact name, ID and value of the database parameter to use this command.\n\nEnter parameter name: upgrade_hmac_fallback_enabled\nEnter parameter value: 0\nEnter configid: 1\n\nCurrent value of parameter [upgrade_hmac_fallback_enabled] is [0]\n\nDo you want to update [upgrade_hmac_fallback_enabled] to [0] in configid [1]? (y/n):y\n[Value of parameter [upgrade_hmac_fallback_enabled] has been updated successfully.\nSkipping Aeris sync for configuration parameter [upgrade_hmac_fallback_enabled] because [FT_TOGGLE_CONFIG_PARAMS_TO_AERIS] is disabled for instance Id: [0].\n[config]$ exit\n[Exits the config shell session.\n\n[root@wifi-security-server1 /]# /etc/init.d/sserverd restart\nStopping sserverd: [ OK ]\n\nStarting sserverd: [ OK ]\n[root@wifi-security-server1 /]#\n```" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0" ] } ], "title": "CVE-2026-102166" } ] }