Velocloud Edge
Monthly
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.
Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.