EUVD-2026-80390
GHSA-9p4p-29rr-fgwc
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
HA functions exposed only on the adjacent HA interconnect (AV:A) with no authentication (PR:N) and low complexity (AC:L); command execution gives full C/I/A on the local Edge, no scope change.
Primary rating from Vendor (Arista).
CVSS VectorVendor: Arista
Lifecycle Timeline
8DescriptionCVE.org
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
AnalysisAI
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) High Availability (HA) explicitly enabled on the VeloCloud Edge units, and (2) network access to the private HA interconnect - the dedicated link/segment carrying peer synchronization traffic between the paired Edge appliances. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N) reflects an unauthenticated (PR:N), low-complexity flaw yielding full confidentiality, integrity and availability impact via elevated command execution - but the single most important limiter is AV:A (adjacent), because the vulnerable functions are exposed only on the private HA interconnect, not the public network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: upgrade VeloCloud Edge to a release above the vulnerable ranges - 5.2.7.0 for the 1.0.0.0-5.2.x line, 6.1.5.0 for the 6.1.x line, and 6.4.2.0 for the 6.4.x line - following Arista Security Advisory 0179 (https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179), and validate the installed version against the advisory's matrix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Arista VeloCloud Edge appliance with High Availability enabled, confirm whether each HA interconnect segment is isolated from untrusted networks, and restrict access to that segment to only the paired Edge peer. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velocloud Edge
View allImproper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software u
OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today