What happened
Arista Networks has issued security updates to address a newly discovered zero-day vulnerability affecting VeloCloud Orchestrator (VCO) deployments. This vulnerability is currently being actively exploited in the wild, with reports indicating that malicious actors are leveraging the flaw to compromise affected systems. The vulnerability exists in the VeloCloud Orchestrator platform, which is widely utilised for network management purposes. At the time of disclosure, no vendor patch was available, highlighting the urgency for affected organisations to implement mitigations to reduce risk.
Who is affected
Organisations running VeloCloud Orchestrator on-premises are impacted by this vulnerability. This includes any deployment that relies on affected versions of the platform for network management functions. The widespread use of VCO in various network environments increases the potential scope of impact, especially in cases where security measures are not promptly updated or mitigations are not in place.
Recommended actions
- Monitor security advisories from Arista Networks for updates and specific instructions related to this vulnerability.
- Implement network security controls to detect and block malicious activity targeting VCO components, focusing on traffic related to the platform’s management interfaces.
- Review and strengthen network perimeter protections, including firewalls and segmentation, to restrict access to VCO management interfaces from untrusted sources.
- Apply mitigation measures or workarounds recommended by Arista until an official patch becomes available.
