Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Summary
Attackers are actively exploiting a critical zero-day SQL injection vulnerability in Arista's VeloCloud Orchestrator (VCO). This flaw allows unauthorized users, even those with read-only access, to escalate their privileges to operator level, gaining significant control over the SD-WAN management system.
IFF Assessment
This vulnerability allows attackers to gain elevated privileges, posing a direct threat to network security and control.
Severity
The vulnerability allows for privilege escalation from read-only to operator level via SQL injection, with a high attack vector and significant impact on confidentiality, integrity, and availability. The exploitability is high as it's a zero-day actively exploited in the wild.
Defender Context
This zero-day highlights the ongoing threat of SQL injection attacks targeting critical infrastructure management systems. Defenders should prioritize patching or implementing mitigating controls for VeloCloud Orchestrator immediately and remain vigilant for signs of unauthorized access or privilege escalation.