What happened
Organisations running Arista VeloCloud Orchestrator are currently experiencing active exploitation of a zero-day SQL injection vulnerability. This flaw was announced by Arista Networks and reported in an advisory issued on October 22. The vulnerability allows attackers to escalate privileges within the VeloCloud Orchestrator, which is the central management system for VeloCloud SD-WAN networks. Specifically, if an attacker can log into the orchestrator— even with a read-only customer account—they can gain operator-level privileges, which provide extensive control over the system. The severity of this vulnerability is considered critical due to its potential impact on network control and integrity. The flaw facilitates privilege escalation with minimal access, enabling malicious actors to compromise the orchestration layer directly. This flaw has been confirmed to be actively exploited in the wild, increasing the urgency for affected organisations to assess their deployment security. Notably, at the time of public disclosure, no vendor patch was available to remediate this vulnerability, further heightening the risk.
Who is affected
Any deployments utilizing the Arista VeloCloud Orchestrator are potentially vulnerable to this zero-day exploit. This includes organisations managing SD-WAN networks through this central platform. Vulnerability exploitation does not require full administrative access initially, as attackers can escalate privileges after logging in with limited credentials. The widespread use of VeloCloud Orchestrator means that a broad range of organisations across various sectors could be impacted, particularly those relying on the system for centralised SD-WAN management and control.
Recommended actions
- Assess current access controls to the VeloCloud Orchestrator, ensuring no unauthorised accounts or abnormal login activity are present.
- Implement robust authentication measures, including multi-factor authentication, to limit access to the orchestrator platform.
- Monitor network traffic for unusual activity indicating attempted or successful privilege escalations.
- Maintain heightened awareness for threat intelligence updates and advisories regarding this vulnerability.
