Arista Issues Critical Advisory for Zero-Day SQL Injection in VeloCloud Orchestrator

Arista warns of a critical zero-day SQL injection vulnerability in VeloCloud Orchestrator, allowing privilege escalation from read-only accounts. The flaw is actively exploited in attacks, posing significant risks to SD-WAN network security.

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.

The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.

For

Read original article