Arista has disclosed that attackers are actively exploiting an unpatched SQL injection bug in VeloCloud Orchestrator, the management platform behind its VeloCloud SD-WAN product line. The flaw lets even a low-privileged, read-only customer account escalate to full operator control over the orchestrator. Arista published an advisory on October 22 and urges affected customers to apply the available mitigations right away.
// source: thehackernews.com ↗