Arista patches VeloCloud Orchestrator zero-day exploited in attacks

· Cybersecurity · United States

Arista Networks released security updates to patch an actively exploited zero-day SQL injection flaw in VeloCloud Orchestrator (VCO) On-Prem deployments, the company said in an October 22 advisory. VCO is the central management system for VeloCloud SD-WAN networks. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, meaning an attacker with a low-privilege foothold can take control of the management plane for a customer's wide-area network. Because the orchestrator governs network configuration across branch sites, compromise at that layer can affect routing and security policy broadly. Administrators of on-premises VCO deployments are urged to apply the fixes promptly.

Why it matters：A management-plane flaw in widely deployed SD-WAN software gives low-privilege attackers control over enterprise networking, and active exploitation means patch urgency is high.

Key points

  • The flaw is a SQL injection in VeloCloud Orchestrator On-Prem.
  • A read-only customer account is enough to gain operator privileges.
  • Arista published the advisory on October 22 and released fixes.

Sources (original reporting)

More stories from this day