{"id":"CVE-2026-102166","kind":"vulnerability","aliases":["CVE-2026-102166"],"related":[],"title":"Arista C-260 and C-250 access points accept forged firmware via shared keys","description":"Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.","summary":"Arista C-260 and C-250 wireless access points ship with the same cryptographic keys on every unit, used to verify firmware images and authenticate SSLP. An attacker who obtains those keys can build modified firmware that passes the device's verification checks.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Arista Wi-Fi Access Points C-260 and C-250","fixed":[],"affected":"All AP releases","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["access-points","arista","c-250","c-260","hardcoded-credentials","infrastructure","title-review","wireless"],"not_affected_if":["eos-products","other-ap-models"],"how_to_check":"- Check your inventory or device labels for Arista Wi-Fi access points C-260 or C-250. All AP software releases on these models are affected; no configuration is needed to be exposed.\n- On-prem CV-CUE/Wi-Fi Manager: on the active HA node, run nerdctl exec -it wifimanager -- bash, su - config, and check upgrade_hmac_fallback_enabled for configid 1 and 3. A value of 0 means the mitigation is applied.\n- Other Arista APs, EOS products, CloudVision, VeloCloud and others are listed by Arista as not affected.","fix":"No fixed release or hotfix as of Arista Security Advisory 0227 (Nov 10, 2026). Apply the vendor mitigation: disable the HMAC-based firmware verification fallback (upgrade_hmac_fallback_enabled = 0).","status":"open","published_at":"2026-11-10T20:17:21+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","triaged_at":"2026-11-10T20:47:17+00:00","updated_at":"2026-11-10T20:51:40+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T20:47:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Arista C-260 and C-250 access points accept forged firmware via shared keys","impact":"high","summary":"Arista C-260 and C-250 wireless access points ship with the same cryptographic keys on every unit, used to verify firmware images and authenticate SSLP. An attacker who obtains those keys can build modified firmware that passes the device's verification checks.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista","wireless","access-points","c-260","c-250"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs modified firmware on access points, bypassing verification checks","analyst_note":"Check the Arista security advisory and NVD entry for the fixed firmware version, the attack prerequisites and whether key rotation or a patch exists.","how_to_check":"- Identify whether any deployed access point is an Arista C-260 or C-250 model; other Arista access point models are stated not to be affected.\n- Check the model label or the device inventory for the C-260 or C-250 model names.","plain_action":"","product_name":"Arista C-260 and C-250 access points","needs_analyst":true,"not_affected_if":["other-ap-models"],"who_is_affected":"Only the Arista C-260 and C-250 access point models are stated to be affected, because they ship with fleet-wide static keys for firmware verification and SSLP authentication. Other access point models enforce signed upgrade images with secure boot and are not affected. The sources do not say what configuration or network position is needed to exploit it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000762,"input_tokens":4587,"output_tokens":606,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Arista security advisory and NVD entry for the fixed firmware version, the attack prerequisites and whether key rotation or a patch exists.","search":"'-102166':17A,20A '-2026':16A,19A '-250':6A,31A,37B,53B,96C,146C '-260':3A,28A,39B,50B,93C,143C 'abl':119C,126C 'accept':9A 'access':7A,25A,33B,55B,97C,121C,149C 'access-point':32B 'affect':163C 'and':29A 'arista':1A,21A,35B,48B,91C 'attack':75B,116C 'authent':72B,114C 'boot':159C 'build':81B 'c':2A,5A,27A,30A,36B,38B,49B,52B,92C,95C,142C,145C 'check':90B,135C 'creat':128C 'credenti':42B 'cryptograph':61B,105C 'cve':15A,18A 'devic':87B 'digit':153C 'enforc':152C 'everi':64B 'fi':24A 'firmwar':11A,69B,83B,109C,130C 'fleet':102C 'fleet-wid':101C 'forg':10A 'hardcod':41B 'hardcoded-credenti':40B 'imag':70B,110C,156C 'infrastructur':43B 'issu':166C 'key':14A,62B,79B,106C,123C 'model':147C,151C 'modifi':82B,129C 'obtain':77B 'pass':85B,133C 'point':8A,34B,56B,98C,150C 'points':26A 'review':46B 'secur':158C 'share':13A 'ship':57B,99C 'sign':154C 'specif':139C 'sslp':73B,113C 'static':104C 'titl':45B 'title-review':44B 'unit':65B 'upgrad':155C 'use':66B,107C 'verif':89B,111C,134C 'verifi':68B 'via':12A 'vulner':137C 'wi':23A 'wi-fi':22A 'wide':103C 'wireless':47B,54B 'would':124C","nicknames":[],"mitigations":[],"who_affected":"Any team running Arista C-260 or C-250 Wi-Fi access points, on any AP software release, is affected. The access points ship with the same static keys on every unit for firmware verification and SSLP authentication, so someone who obtains the keys can build firmware that passes the checks. Arista's CVSS vector is adjacent-network, so look at who can reach the AP management network. Teams without these two models, or with other Arista AP models, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:51:40Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","run_id":2715},"products":{"at":"2026-11-10T20:51:40Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","run_id":2715},"mitigations":{"at":"2026-11-10T20:51:40Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","run_id":2715},"workarounds":{"at":"2026-11-10T20:51:40Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","run_id":2715},"how_to_check":{"at":"2026-11-10T20:51:40Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","run_id":2715},"who_affected":{"at":"2026-11-10T20:51:40Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","run_id":2715}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["aristawifiaccesspointsc260andc250","wifiaccesspointsc260andc250"],"ptokens":["250","260","access","and","arista","fi","points","wi"],"labels":["accesspoints","arista","c250","c260","critical","hardcodedcredentials","infrastructure","titlereview","vendor","wireless"],"campaign_type":null,"search_a":"'-102166':17A,20A '-2026':16A,19A '-250':6A,31A '-260':3A,28A 'accept':9A 'access':7A,25A 'and':29A 'arista':1A,21A 'c':2A,5A,27A,30A 'cve':15A,18A 'fi':24A 'firmwar':11A 'forg':10A 'key':14A 'point':8A 'points':26A 'share':13A 'via':12A 'wi':23A 'wi-fi':22A","search_b":"'-250':37B,53B '-260':39B,50B 'access':33B,55B 'access-point':32B 'arista':35B,48B 'attack':75B 'authent':72B 'build':81B 'c':36B,38B,49B,52B 'check':90B 'credenti':42B 'cryptograph':61B 'devic':87B 'everi':64B 'firmwar':69B,83B 'hardcod':41B 'hardcoded-credenti':40B 'imag':70B 'infrastructur':43B 'key':62B,79B 'modifi':82B 'obtain':77B 'pass':85B 'point':34B,56B 'review':46B 'ship':57B 'sslp':73B 'titl':45B 'title-review':44B 'unit':65B 'use':66B 'verif':89B 'verifi':68B 'wireless':47B,54B","search_c":"'-250':96C,146C '-260':93C,143C 'abl':119C,126C 'access':97C,121C,149C 'affect':163C 'arista':91C 'attack':116C 'authent':114C 'boot':159C 'c':92C,95C,142C,145C 'check':135C 'creat':128C 'cryptograph':105C 'digit':153C 'enforc':152C 'firmwar':109C,130C 'fleet':102C 'fleet-wid':101C 'imag':110C,156C 'issu':166C 'key':106C,123C 'model':147C,151C 'modifi':129C 'pass':133C 'point':98C,150C 'secur':158C 'ship':99C 'sign':154C 'specif':139C 'sslp':113C 'static':104C 'upgrad':155C 'use':107C 'verif':111C,134C 'vulner':137C 'wide':103C 'would':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102166","severity":null,"published_at":"2026-11-10T20:17:21+00:00","modified_at":"2026-11-10T20:17:21+00:00","first_seen_at":"2026-11-10T20:46:01+00:00","fetched_at":"2026-11-10T20:46:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-102166:2715","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","severity":null,"published_at":"2026-11-10T20:51:40+00:00","modified_at":"2026-11-10T20:51:40+00:00","first_seen_at":"2026-11-10T20:51:40+00:00","fetched_at":"2026-11-10T20:51:40+00:00","note":"Read Arista Security Advisory 0227: all AP releases on C-260/C-250 affected, no fix or hotfix; vendor mitigation is disabling the HMAC firmware verification fallback. Not exploited per Arista; no IoCs. Social search skipped (new, vendor-found).","cites":["https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227"]}],"documents":[{"id":118299,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227","title":"Arista Security Advisory 0227","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}