CVE Vulnerability Advisory Database

[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).

[Impact] Authenticated users can escalate to 'superuser operator' privileges, leading to full system compromise and data breach.

[Mitigation] Apply official security patches immediately and restrict network access to the management interface.

[Affected Scope] Cisco Catalyst SD-WAN Manager (formerly vManage) software

[Impact] An unauthenticated, remote attacker can bypass authentication mechanisms and gain full administrative access to the system via crafted HTTP requests.

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to management interfaces using ACLs.

[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.

[Impact] Unauthenticated remote attackers can access privileged internal functions, leading to full compromise of the orchestrator and managed SD-WAN infrastructure.

[Mitigation] Immediately apply the latest security patches from Arista and restrict access to management interfaces via VPN/ACLs.

[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)

[Impact] Unauthenticated remote attackers can access privileged internal functionalities and execute arbitrary OS commands (CWE-78), leading to complete compromise of the orchestrator's confidentiality, integrity, and availability

[Mitigation] Immediately apply the official security patches provided by the vendor and restrict external network access to the orchestrator management interface

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).

[Impact] Unauthenticated remote attackers can bypass peering authentication, gain high-privileged administrative access, and manipulate the entire SD-WAN fabric configuration via NETCONF.

[Mitigation] Apply official Cisco software patches immediately and restrict control plane access to trusted peer IPs using Access Control Lists (ACLs).

[Affected Scope] Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8

[Impact] Unauthenticated remote attackers can exploit SQL injection to manipulate the database, bypass authentication, and ultimately execute arbitrary commands with root privileges.

[Mitigation] Immediately upgrade to the official patched versions (10.2.3 / 10.0.8 or higher) and restrict external access to the management interface.