Velocloud Orchestrator Vco On Prem
Monthly
Unauthenticated remote attackers can reach privileged internal functionality on customer-hosted (on-prem) Arista VeloCloud Orchestrator deployments, potentially compromising the confidentiality, integrity, and availability of the orchestrator itself and the data it manages. The vulnerable code path is exposed pre-authentication (PR:N) with no user interaction required, though the vendor's CVSS 4.0 vector and our independent assessment both assign high attack complexity (AC:H), indicating exploitation depends on specific conditions or non-trivial request crafting rather than a single trivial call. Arista-managed Hosted and Dedicated VCO instances have already been patched and are not at risk; only customer-run on-prem VCO appliances remain exposed, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can reach privileged internal functionality on customer-hosted (on-prem) Arista VeloCloud Orchestrator deployments, potentially compromising the confidentiality, integrity, and availability of the orchestrator itself and the data it manages. The vulnerable code path is exposed pre-authentication (PR:N) with no user interaction required, though the vendor's CVSS 4.0 vector and our independent assessment both assign high attack complexity (AC:H), indicating exploitation depends on specific conditions or non-trivial request crafting rather than a single trivial call. Arista-managed Hosted and Dedicated VCO instances have already been patched and are not at risk; only customer-run on-prem VCO appliances remain exposed, and no public exploit code has been identified at time of analysis.