CVE-2026-102155: CWE-611 Improper Restriction of XML External Entity Reference in Arista Networks CloudVision CUE

This vulnerability (CWE-611) in Arista Networks CloudVision CUE's WiFi-server Spectralight application permits authenticated users to exploit XML External Entity injection. By sending malicious XML requests, attackers can read arbitrary local files on the server and induce partial denial of service conditions. The flaw affects versions >=2021.2.0 and <=2026.2.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges but no user interaction, with high confidentiality impact and low availability impact.

Successful exploitation can lead to disclosure of sensitive local files on the affected system and partial denial of service, potentially impacting confidentiality and availability of the CloudVision CUE service. Integrity is not affected. The vulnerability requires authentication but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Arista Networks advisories for updates. Until a fix is available, restrict access to authenticated users and consider limiting exposure of the WiFi-server Spectralight application to trusted networks.