What happened
An active vulnerability has been identified in the Arista VeloCloud Orchestrator, which is used for managing network virtualisation and orchestration services. This issues a SQL injection flaw that could allow an unauthenticated remote attacker to access privileged internal functionality and potentially impact the host operating system hosting the orchestrator. Exploitation of this weakness may compromise the confidentiality, integrity, and availability of data and services managed by the orchestrator. The vulnerability has been confirmed to be actively exploited in the wild, increasing the risk for affected deployments.
Who is affected
Organisations running on-premises instances of the Arista VeloCloud Orchestrator are affected by this vulnerability. Any deployment exposed to the internet without adequate protections may be at risk, particularly if mitigations have not been applied. The affected component is the Arista VeloCloud Orchestrator, and affected environments include those where the product is accessible remotely. As exploitation is confirmed to be active, affected organisations should assess exposure and immediate mitigation measures.
Recommended actions
- Apply mitigations in accordance with vendor instructions.
- Ensure compliance with CISA’s BOD 26-04 guidance on prioritising security updates based on risk.
- Follow applicable BOD 26-04 guidance for cloud services or consider discontinuing use of the product if mitigations are not available.
- Evaluate each deployment's internet exposure to determine the appropriate response and protect against unauthorised access.
