Arista patches VeloCloud Orchestrator zero-day reportedly exploited in attacks
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Arista
- Product
- VeloCloud Orchestrator
- First seen
Summary
A post linking a BleepingComputer article reports that Arista has patched a new zero-day in VeloCloud Orchestrator. The article is reported to say the flaw is being exploited in attacks, but the post itself contains only the link, so the CVE ID, CVSS score and exploitation details are unconfirmed here.
If you use Arista
Check Arista's security advisory and apply the VeloCloud Orchestrator patch
Restrict access to the Orchestrator management interface
Review logs for SQL injection indicators
Confirm the CVE ID and scope against the vendor advisory
What the sources say 1
· Mastodon: “https://www. bleepingcomputer.com/news/secu rity/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks # ZeroDay # SQLInjection # Arista # VeloCloud # CyberSecurity # PatchedOrPerish” Source