Hujumchilar Arista'ning VeloCloud Orchestrator (VCO) — VeloCloud SD-WAN tarmoqlari uchun markaziy boshqaruv tizimi — dagi nol kunlik SQL injection zaifligidan foydalanmoqda, deb kompaniya 22-oktabrda e'lon qildi.
Bu zaiflik orkestratorga kirish huquqiga ega bo'lgan har kimga, hatto faqat o'qish huquqiga ega mijoz hisobiga ham, operator darajasidagi eng yuqori nazorat huquqini olish imkonini beradi.
Mahalliy (on-premises) orkestratorlar uchun tuzatish VCO 5.2.3.18, 6.1.3.10 va 6.4.2.12 versiyalarida mavjud, Hosted va Dedicated orkestratorlar esa allaqachon tuzatilgan.
Zaiflik CVE-2026-114625 sifatida kuzatiladi va CVSS shkalasi bo'yicha 9,9 ball bilan baholangan. Iyul va sentyabr oylarida foydalanilgan VCO zaifliklarini tuzatgan relizlar hali ham ta'sirlangan, chunki bu relizlar yangi tuzatishlardan eski.
Arista VeloCloud SD-WAN mahsulot liniyasini Broadcom'dan sotib olganini 2025-yil iyul oyida e'lon qilgan. Bu mahsulotlar avval VMware SD-WAN by VeloCloud nomi bilan tanilgan.
Zaiflikdan foydalanish uchun hujumchiga orkestratorning veb-interfeysiga tarmoq orqali kirish va haqiqiy login kerak. Minimal rol — Enterprise Read Only, ya'ni mijoz foydalanuvchilari uchun eng past darajadagi o'rnatilgan rol. VCO sukut bo'yicha ochiq va hech qanday VCO sozlamasi bu ochiqlikni oldini olmaydi.
VCO'da operatorlar mijoz va hamkor hisoblarini yaratadi, har bir hamkor esa bir guruh mijozlarni boshqarishi mumkin. Bu zaiflik hujumchiga to'liq kirish huquqiga ega mahalliy superfoydalanuvchi sifatida harakat qilish imkonini beradi. Shuningdek, u VCO xostining o'ziga ta'sir qilishi va orkestrator hamda u boshqaradigan ma'lumotlarni ochish, o'zgartirish yoki buzishi mumkin.
Maslahatda hujumlar qachon boshlanganligi, qaysi orkestratorlar zararlangani yoki hujumchilar zaiflikdan foydalangandan keyin nima qilgani aytilmagan.
Bu yangi zaiflik iyul oyining oxiridan beri Arista tomonidan foydalanilayotgani e'lon qilingan VCO'dagi uchinchi zaiflik bo'lib, uchalasidan birinchisi login talab qiladi. Iyul zaifligi (CVE-2026-16812) va sentyabr zaifligi (CVE-2026-93952) login talab qilmagan.
Ta'sirlangan va tuzatilgan relizlar
Har bir ta'sirlangan reliz liniyasi o'z tuzatishiga ega, bu yerda sentyabr zaifligini tuzatgan reliz bilan birga ko'rsatilgan.
| Reliz liniyasi | CVE-2026-114625 ta'sirlangan | Tuzatilgan | CVE-2026-93952 (sentyabr) tuzatilgan |
|---|---|---|---|
| 5.2 | 5.2.3.18 dan oldin | 5.2.3.18 va undan keyin | 5.2.3.16 |
| 6.1 | 6.1.3.10 dan oldin | 6.1.3.10 va undan keyin | Tuzatish ro'yxatda yo'q |
| 6.4 | 6.4.2.12 dan oldin | 6.4.2.12 va undan keyin | 6.4.2.8 |
VeloCloud Gateway va VeloCloud Edge ta'sirlanmagan. 7.0 reliz liniyasi ro'yxatda yo'q va Arista ro'yxatda bo'lmagan har qanday reliz zaif emasligini aytadi.
Arista qo'llab-quvvatlash muddati tugagan relizlarni tekshirmagan. Qo'llab-quvvatlanmaydigan reliz liniyasida bo'lgan mijozlar yangilash variantlari haqida Arista Technical Assistance Center (TAC) bilan bog'lanishlari mumkin.
22-oktabr holatiga ko'ra, sentyabr zaifligi faqat 5.2 va 6.4 liniyalarida tuzatilgan. 6.1 liniyasida u 6.1.3.7 gacha bo'lgan relizlarga ta'sir qiladi va tuzatilgan reliz ro'yxatda yo'q. Hech bir maslahat 6.1.3.10 sentyabr zaifligini ham tuzatadimi yoki yo'qmi, deb aytmaydi.
Agar hozircha yangilay olmasangiz
Tuzatilgan reliz o'rnatilgunga qadar Arista quyidagi choralarni tavsiya qiladi:
- VCO veb-interfeysiga kirishni faqat ishonchli ma'muriy tarmoqlarga cheklang.
- VCO'ni ma'lum zararli IP manzillardan keladigan ulanishlar uchun kuzating.
- VCO xostidan kutilmagan tashqi tarmoq faoliyatini kuzating.
- Oddiy ishlash uchun kerak bo'lmagan tashqi portlarni bloklashni ko'rib chiqing.
- Orqa eshik demonlari va vebshellarni kuzating.
- So'nggi ma'muriy faoliyatni kutilmagan o'zgarishlar uchun tekshiring.
Buzilishni tekshirish
Arista ma'lumotiga ko'ra, hujumlarni amalga oshirgan ikkita IP manzil kuzatilgan. Ularni bloklang va loglarda ular haqida har qanday belgini tekshiring:
- IP: 74.82.197[.]86
- IP: 38.54.50[.]151
Shuningdek, VCO veb-kirish loglarini g'ayrioddiy URL-ga o'xshash yo'l komponentlari, kodlangan belgilar, mahalliy yoki ichki xizmatlarga havolalar yoki yuqori so'rov tezligi bo'yicha tekshiring.
Agar buzilishdan shubhalansangiz, iloji bo'lsa, tuzatishdan oldin dalillarni saqlang. Bu VCO veb-kirish, orqa tomon ilova, tizim va ma'lumotlar bazasi loglari, shuningdek tegishli fayl tizimi vaqt belgilari demakdir.
Iyul va sentyabr zaifliklari haqida Arista ogohlantirdiki, buzilgan orkestrator hujumchilarga VeloCloud Edge qurilmalariga ham kirish huquqini berishi mumkin. Bu zaiflik uchun maslahat bu xavf amal qiladimi yoki yangilash hujumchi allaqachon olgan kirishni yo'qotadimi, deb aytmaydi.
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.
The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it.
For on-premises orchestrators, the fix is in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, while Hosted and Dedicated orchestrators have already been patched.
The flaw is tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale. Orchestrators running the releases that fixed the VCO flaws exploited in July and September are still affected, because those releases are older than the new fixes.
Arista bought the VeloCloud SD-WAN product line from Broadcom, announcing the deal in July 2025. The products were earlier known as VMware SD-WAN by VeloCloud.
To exploit the flaw, an attacker needs network access to the orchestrator's web interface and a valid login. The minimum role is Enterprise Read Only, the lowest built-in role for customer users. VCO is exposed by default, and no VCO setting prevents the exposure.
In VCO, operators create the customer and partner accounts, and each partner can manage a group of customers. The flaw allows an attacker to act as a local superuser, a role with full access. It may also allow an attacker to affect the VCO host itself and expose, modify, or disrupt the orchestrator and the data it manages.
The advisory does not say when the attacks began, which orchestrators were hit, or what the attackers did after exploiting the flaw.
The new flaw is the third in VCO since late July that Arista has reported as exploited, and the first of the three that requires a login. Neither the July flaw (CVE-2026-16812) nor the September flaw (CVE-2026-93952) needed one.
Affected and Fixed Releases
Each affected release train has its own fix, shown here beside the release that fixed September's flaw on the same train.
| Release train | Affected by CVE-2026-114625 | Fixed in | CVE-2026-93952 (September) fixed in |
|---|---|---|---|
| 5.2 | Before 5.2.3.18 | 5.2.3.18 and later | 5.2.3.16 |
| 6.1 | Before 6.1.3.10 | 6.1.3.10 and later | No fix listed |
| 6.4 | Before 6.4.2.12 | 6.4.2.12 and later | 6.4.2.8 |
VeloCloud Gateway and VeloCloud Edge are not affected. The 7.0 release train is not on the list, and Arista says any release not on the list is not vulnerable.
Arista has not checked releases that have reached end of support. Customers on an unsupported release train can contact Arista's Technical Assistance Center (TAC) about upgrade options.
As of October 22, September's flaw is fixed only in the 5.2 and 6.4 trains. On 6.1, it affects releases up to 6.1.3.7, and no fixed release is listed. Neither advisory says whether 6.1.3.10 also fixes the September flaw.
If You Cannot Upgrade Yet
Until the fixed release is installed, Arista recommends these steps:
- Limit access to the VCO web interface to trusted administrative networks.
- Monitor the VCO for connections from known malicious IP addresses.
- Watch for unexpected outbound network activity from the VCO host.
- Consider blocking outbound ports that normal operation does not need.
- Watch for backdoor daemons and webshells.
- Review recent administrator activity for unexpected changes.
Checking for Compromise
Two IP addresses have been seen carrying out the attacks, according to Arista. Block them and check logs for any sign of them:
- IP: 74.82.197[.]86
- IP: 38.54.50[.]151
Also check VCO web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates.
If you suspect a compromise, save evidence before fixing anything, where possible. That means the VCO web access, backend application, system and database logs, along with the relevant file-system timestamps.
Regarding the July and September flaws, Arista warned that a compromised orchestrator could also grant attackers access to VeloCloud Edge devices. For this flaw, the advisory does not say whether the risk applies or whether upgrading removes access that an attacker has already gained.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.