An authenticated input validation flaw exists in the flow metrics API of Arista's VeloCloud Orchestrator. Because the API fails to sanitize user-supplied parameters, an authenticated user can inject arbitrary SQL that is passed directly to backend databases. This permits the attacker to read data beyond their intended permissions and to cause the system to initiate unintended outbound network connections. The vulnerability is a classic SQL Injection and is classified under CWE‑89.

Arista Networks VeloCloud Orchestrator On‑Prem is affected. Versions earlier than VCO 5.2.3.14 in the 5.2 train, earlier than VCO 6.1.3.4 in the 6.1 train, and earlier than VCO 6.4.2.4 in the 6.4 train are vulnerable.

The vulnerability has a CVSS score of 8.5, indicating high severity. The EPSS score is 3%, giving a moderate likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog, indicating no publicly known exploitation yet. Nevertheless, because it requires authentication, an internal or compromised administrative account can exploit it. If exploited, the attacker can extract confidential data and trigger unsolicited outbound traffic, potentially facilitating lateral movement. The lack of public exploitation data does not reduce the need for remediation.