Threat intel
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Arista has warned that attackers are actively exploiting a critical zero-day SQL injection flaw in VeloCloud Orchestrator, the central management system for its SD-WAN product. According to The Hacker News, even a read-only account can be abused to gain top-level operator privileges.
Arista Networks has warned customers that attackers are actively exploiting a critical zero-day SQL injection vulnerability in VeloCloud Orchestrator (VCO), the centralized management platform for VeloCloud SD-WAN deployments, according to The Hacker News.
In an advisory issued on October 22, the company said the flaw allows any user who can log in to the orchestrator — including someone holding only a read-only customer account — to escalate their access to operator privileges, the highest level of control over the system.
Because the orchestrator sits at the heart of VeloCloud SD-WAN environments, a successful compromise could give an attacker sweeping influence over an organization's wide-area network. Operator-level access to a central SD-WAN controller potentially exposes configuration data, network policies and connected sites across an enterprise.
Key points:
- The vulnerability is a SQL injection flaw in VeloCloud Orchestrator.
- It is being exploited in real-world attacks as a zero-day.
- Exploitation requires only low-privileged, read-only access to the orchestrator.
- A successful attack yields operator privileges, the top tier of control.
The material provided does not include details beyond the advisory's core findings, such as the number of affected versions, specific fixes, or the identity of the attackers behind the exploitation. Given that attacks are already under way, organizations running VeloCloud Orchestrator should consult Arista's advisory promptly and follow its recommended mitigation guidance.
Source: The Hacker News
