On October 22, Arista Networks released an advisory regarding a critical zero-day SQL injection vulnerability impacting the VeloCloud Orchestrator (VCO). The VCO serves as the central management system for VeloCloud SD-WAN networks, providing a unified interface for configuration and monitoring. This security flaw has already been exploited in active attacks according to the company's report.

The vulnerability allows an attacker with existing login credentials to the orchestrator to elevate their permissions. Even accounts with the lowest level of access, such as read-only customer roles, can exploit the flaw to gain operator privileges. Reaching this level of control grants the attacker the highest possible administrative oversight of the SD-WAN environment, potentially compromising the entire network infrastructure managed through the platform.

Organizations utilizing VeloCloud SD-WAN should review their orchestrator logs for suspicious administrative activity and apply any recommended patches or mitigations from the vendor. IT leaders and managed service providers are advised to audit user permissions and ensure that access to central management systems is strictly monitored to prevent unauthorized privilege escalation within their network architecture.

The BroadVision view

This vulnerability highlights the risk inherent in centralized management consoles where a single flaw can bypass granular access controls. Mid-market IT teams must prioritize the security of their SD-WAN orchestrators to protect against lateral movement and unauthorized privilege gains. Strengthening the management layer is essential for maintaining reliable connectivity infrastructure. Teams weighing what to change first can review BroadVision's managed IT services.