Arista VeloCloud Orchestrator SQL Injection Vulnerability (SA0199)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(374263);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/02");

  script_cve_id("CVE-2026-114625");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/10/26");

  script_name(english:"Arista VeloCloud Orchestrator SQL Injection Vulnerability (SA0199)");

  script_set_attribute(attribute:"synopsis", value:
"The version of Arista VeloCloud Orchestrator (VCO) running on the remote device is affected by a SQL injection
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Arista VeloCloud Orchestrator running on the remote device is affected by a SQL injection vulnerability
as referenced in security advisory SA0199.

  - A SQL injection vulnerability exists in Arista VeloCloud Orchestrator. A remote attacker could access
    privileged internal functionality and impact the VCO host. Successful exploitation may compromise the
    confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On
    an affected system, any authenticated user can gain operator privileges and masquerade as a local
    'superuser operator' user. This includes access to functionality that is intended for internal use only and
    which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted
    and have already been patched. (CVE-2026-114625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b2866563");
  script_set_attribute(attribute:"solution", value:
"Upgrade the Arista VeloCloud Orchestrator to 5.2.3.18 / 6.1.3.10 / 6.4.2.12 or later, or apply the mitigation referenced
in the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-114625");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/30");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:arista:velocloud_orchestrator");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("arista_velocloud_orchestrator_web_detect.nbin");
  script_require_keys("installed_sw/Arista VeloCloud Orchestrator");
  script_require_ports("Services/www", 443);

  exit(0);
}

include('vdf.inc');

# @tvdl-content

var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Arista VeloCloud Orchestrator', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '5.2', 'fixed_version': '5.2.3.18'},
        {'min_version': '6.1', 'fixed_version': '6.1.3.10'},
        {'min_version': '6.4', 'fixed_version': '6.4.2.12'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);