WORLDTECHArista ships fix for actively exploited VeloCloud Orchestrator flaw
Arista Networks has released critical security updates to close a zero-day vulnerability in its VeloCloud Orchestrator (VCO) On-Prem deployments, a flaw that attackers were already exploiting before the fix became available, according to a report by BleepingComputer.
What the flaw allows
Arista said in an advisory dated October 22 that attackers are exploiting a zero-day SQL injection flaw in VCO, the central management system for VeloCloud SD-WAN networks. A zero-day is a vulnerability that is being used in attacks before a fix exists.
According to the advisory, the flaw allows anyone able to log in to the orchestrator, including a holder of a read-only customer account, to gain operator privileges, the highest level of control over the system.
Patches cover On-Prem deployments
The security updates target VCO On-Prem deployments, meaning orchestrators that customers run on their own infrastructure. BleepingComputer, which reported the release, is the only outlet cited for the patch announcement, and the facts available to WORLDTECH do not describe the scope of affected customers or the number of systems exposed.
Open questions
- How many On-Prem VCO deployments are affected and how many have been patched?
- Who is behind the attacks, and how long has the flaw been exploited?