Vulnerability feed

Executive summary

Arista's VeloCloud Orchestrator (VCO) on-prem software has a flaw that lets any authenticated user gain operator-level privileges and reach internal-only functions. The advisory rates it critical (CVSS v3.1 base score 9.9) and says it is known to be actively exploited. The vendor recommends upgrading to a fixed VCO release as soon as possible.

Technical summary

The advisory classifies the issue as CWE-89 SQL Injection, and says a remote attacker with a valid authenticated session can become a local "superuser operator" and reach internal-only functionality. Exploitation requires network access to the VCO web interface and a session for at least the Enterprise Read Only role, and the advisory states VCO is exposed by default with no configuration that prevents exposure. Affected versions are VCO 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, and 6.4.x prior to 6.4.2.12, with fixed releases 5.2.3.18, 6.1.3.10, and 6.4.2.12 and later. End-of-support versions have not been assessed. The advisory lists indicators of compromise, including two IP addresses (74.82.197.86 and 38.54.50.151) and suspicious web access log patterns, and recommends blocking those IPs and reviewing logs. No workaround that removes the exposure is stated; the advisory recommends restricting web interface access, monitoring for webshells and backdoor daemons, and reviewing administrator activity until patching.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

AristaArista NetworksArista VeloCloud OrchestratorArista Networks VeloCloud OrchestratorArista VeloCloud Orchestrator (VCO)Arista VeloCloud Orchestrator On-Prem

Executive summary

Arista's VeloCloud Orchestrator on-premises software has a SQL injection flaw that lets an authenticated user gain operator privileges and reach internal-only functions. The advisory rates it critical (CVSS v3.1 base score 9.9) and says it is known to be actively exploited. The vendor recommends upgrading to a fixed release as soon as possible, and restricting access to the orchestrator's web interface until then.

Technical summary

The flaw is classified as CWE-89 SQL injection and is reachable over the network through the VCO web interface. Exploitation requires a valid authenticated session, with the lowest role being Enterprise Read Only, and the advisory states there is no configuration that prevents the exposure. Affected versions are 5.2.x prior to 5.2.3.18, 6.1.x prior to 6.1.3.10, and 6.4.x prior to 6.4.2.12, and fixed versions are 5.2.3.18, 6.1.3.10, and 6.4.2.12 and later in their trains. Workarounds are not stated beyond defense-in-depth controls such as restricting web interface access, monitoring for known malicious IPs (74.82.197.86 and 38.54.50.151), reviewing web access logs for unusual paths, and watching for webshells and backdoor daemons. The advisory does not state end-of-support versions, which were not assessed.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

AristaArista VeloCloud Orchestrator