SQL injection in VMware SD-WAN by VeloCloud
Priority MEDIUM 40CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.
Why it matters now
EPSS 0.01129 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware SD-WAN by VeloCloud | VMware SD-WAN by VeloCloud 3.2.x, 3.3.x prior to 3.3.2 p2, 3.4.x prior to 3.4.1 | — | No fix listed | CNA |
- VMware SD-WAN by VeloCloud Vendor— Affected VMware SD-WAN by VeloCloud 3.2.x, 3.3.x prior to 3.3.2 p2, 3.4.x prior to 3.4.1 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* | 3.1.1 to before 3.3.2 | Vulnerable | Arista |
| cpe:2.3:a:arista:velocloud_orchestrator:3.3.2:-:*:*:*:*:*:* | 3.3.2 | Vulnerable | Arista |
| cpe:2.3:a:arista:velocloud_orchestrator:3.4.0:*:*:*:*:*:*:* | 3.4.0 | Vulnerable | Arista |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:* Versions 3.1.1 to before 3.3.2 Vulnerable ·Arista
- cpe:2.3:a:arista:velocloud_orchestrator:3.3.2:-:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·Arista
- cpe:2.3:a:arista:velocloud_orchestrator:3.4.0:*:*:*:*:*:*:* Versions 3.4.0 Vulnerable ·Arista
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-3973
- 2026-10-03 Alias added: GHSA-jw5c-g9mh-p498
References
More Arista Velocloud Orchestrator vulnerabilities
- TI-2026-79524 Privilege escalation in Arista VeloCloud Orchestrator on-premises KEVCVSS 4.0CRITICAL 9.4
- TI-2026-63212 Improper input validation in Arista VeloCloud Orchestrator On-Prem KEVCVSS 4.0CRITICAL 9.5
- TI-2026-13992 VeloCloud Orchestrator OS Command Injection KEVCVSS 4.0CRITICAL 10.0
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2020-3973 · CVE Program
- CVE-2020-3973 · NVD
- FIRST EPSS
- GHSA-jw5c-g9mh-p498 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences