{"id":"CVE-2026-102155","published":"2026-10-06T20:17:10.400","lastModified":"2026-10-07T13:38:48.657","description":"An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An XML External Entity (XXE) vulnerability in Spectralight's WiFi-server allows authenticated users to read arbitrary local files and cause partial denial of service by crafting malicious XML requests.","exploitability":"Exploitation requires an authenticated user account with access to the WiFi-server functionality, making it moderately difficult but not highly complex to achieve.","blast_radius":"If exploited, this vulnerability could lead to sensitive configuration files, credentials, and system information disclosure across the affected network infrastructure.","remediation":"Disable XML parsing functionality in the WiFi-server until a patch is available, or restrict access to the vulnerable endpoints to authenticated users only.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xxe","web","local-file-disclosure","denial-of-service"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:54:20.191Z"}}