Overview of the Vulnerability
VeloCloud Orchestrator (VCO) is a web-based management portal used to configure, monitor, and manage VeloCloud SD-WANs and edge devices. A zero-day vulnerability, tracked as CVE-2026-114625, allows attackers with basic privileges to escalate privileges through SQL injection attacks. This flaw can compromise the confidentiality, integrity, and availability of the orchestrator and data managed by it. Arista has patched hosted VCO deployments running version 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later.
Key Recommendations
- Monitor for Connections from Known Malicious IP Addresses: Admins should monitor for connections from known malicious IP addresses and block them to prevent unauthorized access. Arista recommends blocking IP addresses such as 74.82.197.86 and 38.54.50.151, which have been observed during ongoing attacks.
- Restrict Access to the VCO Web Interface: To prevent unauthorized access, restrict access to the VCO web interface to administrative networks only. Admins should also review recent administrator activity for unusual changes, such as requests with unusual URL-like path components, encoded characters, references to local or internal services, and high request rates.
- Review VCO Web Access Logs: Admins should review VCO web access logs for suspicious activity, such as requests with unusual components, encoded characters, references to local or internal services, and high request rates. This can help identify potential threats and ensure that the system remains secure.
Actionable Tips
- Implement Strong Authentication and Authorization: Ensure that all users have strong authentication and authorization mechanisms in place to prevent unauthorized access. This includes using multi-factor authentication and limiting access to the VCO web interface to only authorized personnel.
- Regularly Update and Patch Systems: Regularly update and patch VCO and other systems to ensure that they are protected against known vulnerabilities. This includes keeping the VCO web interface up to date with the latest security patches and updates.
- Conduct Regular Security Audits and Penetration Testing: Conduct regular security audits and penetration testing to identify and address any vulnerabilities in VCO and other systems. This can help prevent future attacks and ensure that the system remains secure.
Conclusion
Arista has taken the necessary steps to patch the VeloCloud Orchestrator (VCO) zero-day vulnerability, but it is essential for admins to implement the recommended security measures to prevent exploitation. By following these key recommendations and best practices, admins can ensure that VCO remains secure and protected against potential threats.