---
id: "CVE-2026-102166"
page: "https://infrastack.ai/live/CVE-2026-102166"
kind: "vulnerability"
aliases: ["CVE-2026-102166"]
title: "Arista C-260 and C-250 access points accept forged firmware via shared keys"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Arista Wi-Fi Access Points C-260 and C-250", "fixed": [], "affected": "All AP releases", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["access-points", "arista", "c-250", "c-260", "hardcoded-credentials", "infrastructure", "title-review", "wireless"]
not_affected_if: ["eos-products", "other-ap-models"]
published_at: "2026-11-10T20:17:21+00:00"
first_seen_at: "2026-11-10T20:46:01+00:00"
updated_at: "2026-11-10T20:51:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102166", "first_seen_at": "2026-11-10T20:46:01+00:00"}, {"source": "analyst", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227", "first_seen_at": "2026-11-10T20:51:40+00:00", "cites": ["https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227"]}]
exploit_sources: []
---

# Arista C-260 and C-250 access points accept forged firmware via shared keys

Link for people: https://infrastack.ai/live/CVE-2026-102166 (this .md is for agents)

Arista C-260 and C-250 wireless access points ship with the same cryptographic keys on every unit, used to verify firmware images and authenticate SSLP. An attacker who obtains those keys can build modified firmware that passes the device's verification checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Arista Wi-Fi Access Points C-260 and C-250 affected All AP releases fixed no fixed version listed

## How to check

- Check your inventory or device labels for Arista Wi-Fi access points C-260 or C-250. All AP software releases on these models are affected; no configuration is needed to be exposed.
- On-prem CV-CUE/Wi-Fi Manager: on the active HA node, run nerdctl exec -it wifimanager -- bash, su - config, and check upgrade_hmac_fallback_enabled for configid 1 and 3. A value of 0 means the mitigation is applied.
- Other Arista APs, EOS products, CloudVision, VeloCloud and others are listed by Arista as not affected.

## Fix

No fixed release or hotfix as of Arista Security Advisory 0227 (Nov 10, 2026). Apply the vendor mitigation: disable the HMAC-based firmware verification fallback (upgrade_hmac_fallback_enabled = 0).

## Timeline

- 2026-11-10T20:46:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102166
- 2026-11-10T20:51:40+00:00 analyst https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227 — Read Arista Security Advisory 0227: all AP releases on C-260/C-250 affected, no fix or hotfix; vendor mitigation is disabling the HMAC firmware verification fallback. Not exploited per Arista; no IoCs. Social search skipped (new, vendor-found).

## Documents

- [advisory] Arista Security Advisory 0227 https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227

## From the sources

Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_