HighZero-Day
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
BleepingComputer·Source published ·1 min read
What happened?
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
Key details
- Authenticated users can gain operator privileges and masquerade as superuser operator.
- Hosted VCO deployments patched on version 5.2.3.18 or later, 6.1.3.10 or later, 6.4.2.12 or later.
- Arista blocks two malicious IP addresses observed in ongoing attacks.
- Arista has patched three other actively exploited zero-days this year affecting EOS and VCO.
- Once attackers have valid credentials, prevention drops sharply to 37% blocked actions.
- Arista is a Fortune 500 company with over 10,000 customers worldwide.
Fixes and mitigations
- Patch VCO to version 5.2.3.18 or later, 6.1.3.10 or later, or 6.4.2.12 or later.
What to look for
- Review VCO web access logs for suspicious activity with unusual URL paths or encoded characters.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.