Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited
Arista disclosed a critical zero-day SQL injection vulnerability in its VeloCloud Orchestrator, exploited to escalate privileges despite read-only accounts, impacting SD-WAN management systems.
Why it matters
The flaw enables attackers to gain operator-level access to VeloCloud Orchestrator, potentially compromising SD-WAN network control and security.
SOC impact
Investigate activity involving privilege elevation attempts on VeloCloud Orchestrator instances. Monitor for anomalous behavior from accounts with read-only permissions. Confirm which assets use the affected Orchestrator version and assess exposure.
Recommended actions
- Identify VeloCloud Orchestrator deployments in your environment
- Review access logs for unusual privilege escalation activity
- Monitor accounts with read-only permissions for suspicious operations
- Consult The Hacker News advisory for detailed vulnerability information
- Coordinate with network and SD-WAN teams to assess potential impact
Executive Summary
Arista has reported a critical zero-day SQL injection vulnerability affecting VeloCloud Orchestrator, the central management system for VeloCloud SD-WAN networks. Attackers have exploited this flaw to escalate privileges beyond the limitations of read-only accounts, raising significant security concerns for SD-WAN infrastructures managed through this platform. Operationally, this vulnerability increases the risk of unauthorized high-level access within network management environments, warranting immediate review of relevant telemetry and asset inventories to identify potential exploitation or exposure.
SOC Impact
Investigate activity involving privilege elevation attempts on VeloCloud Orchestrator instances. Monitor for anomalous behavior from accounts with read-only permissions. Confirm which assets use the affected Orchestrator version and assess exposure.
Authentication and Access Validation
- Identify VeloCloud Orchestrator deployments in your environment
- Review access logs for unusual privilege escalation activity
- Monitor accounts with read-only permissions for suspicious operations
- Consult The Hacker News advisory for detailed vulnerability information
- Coordinate with network and SD-WAN teams to assess potential impact
Why It Matters
The flaw enables attackers to gain operator-level access to VeloCloud Orchestrator, potentially compromising SD-WAN network control and security.