Arista Alerts on Critical VeloCloud SQL Injection Zero-Day

Arista Networks released an advisory on October 22 alerting users of its VeloCloud SD‑WAN orchestrator platform to a critical zero‑day SQL injection vulnerability that can elevate read‑only accounts to operator level and grant operator-level control over the fabric. The flaw resides in the VeloCloud Orchestrator (VCO), the central management engine for Arista’s VeloCloud SD‑WAN deployments, and allows anyone who can log into the orchestrator—even with minimal permissions—to inject malicious SQL commands that bypass authentication checks and return elevated privileges. This effectively gives an attacker full administrative authority over the entire SD‑WAN fabric, enabling lateral movement across all connected sites and devices ¹.

Arista assigned a CVSS score of “critical” to the issue due to its potential impact on confidentiality, integrity, and availability. It urged customers to isolate vulnerable components until vendor updates are issued ¹.

The vulnerability mirrors long‑standing concerns about SQL injection flaws in enterprise software; similar issues have plagued Cisco routers since 2016 and were highlighted again in Palo Alto Networks’ Prisma Access in early 2024. In both cases, attackers could exploit basic read permissions to gain higher privilege levels through crafted queries.

The Arista flaw follows this pattern: it exploits a logic error where input parameters are not properly sanitized before being incorporated into database statements, allowing arbitrary code execution within the orchestrator’s backend. Because VCO serves as the single point of control for thousands of SD‑WAN nodes worldwide, a successful exploitation could affect many devices under its management scope ¹.

Organizations relying on VeloCloud should immediately verify their deployed version against Arista’s advisory and consider temporarily disabling remote access or applying network segmentation until a fix arrives ¹.

Once inside, an attacker could reconfigure routing policies and manipulate telemetry, enabling broader attacks across corporate networks ¹. This aligns with expert observations that such orchestration platforms often become high‑value targets because they provide broad reach once compromised. The potential lateral movement is particularly alarming given that many customers grant read‑only accounts to third‑party vendors or internal teams; the zero‑day flaw turns these minimal privileges into full control without additional authentication steps.

Arista’s warning underscores the need for continuous vulnerability scanning and rapid patch deployment in modern software‑defined networking environments. Experts recommend adopting secure coding practices, including input validation and least‑privilege enforcement, as part of the software development lifecycle. They also advise organizations to maintain up‑to‑date inventories of all orchestration components and apply the principle of “defense in depth” by combining network segmentation, role‑based access controls, and real‑time monitoring to detect anomalous SQL activity early ¹.

In short, Arista’s Oct 22 advisory reveals a severe security gap in its VeloCloud Orchestrator that lets attackers gain operator privileges from any logged‑in user, potentially compromising entire SD‑WAN deployments. Customers should verify their version, isolate exposed services where possible, and await an official patch while applying interim mitigations such as disabling remote management interfaces or enforcing stricter role restrictions on orchestrator accounts.