SecBoard
Zurück zur CVE-Übersicht

CVE-2026-86107

MEDIUM(5.9)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Risk Signal Score20/100 — NIEDRIG
  • CVSS 5.9 — Mittel

Erwähnungen (letzte 60 Tage)

Artikel

Beschreibung

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "NetworkSession" and Protocol == "UDP"
| where RemotePort == 4500 // VCMP tunnel protocol often uses UDP 4500 for IPsec/NAT-T
| where InitiatingProcessFileName has_any ("velocloud", "vcmp") // Adjust based on actual process names
| summarize count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| where count_ > 50 // Threshold for unusual high volume of tunneled IP fragments
| project DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, count_

Splunk SPL

index=* (velocloud OR vcmp) sourcetype=network_traffic protocol=udp dest_port=4500
| stats count by host, dest_ip, dest_port, process_name
| where count > 50

Sigma

title: VeloCloud VCMP Tunnel OOB Write Attempt
status: experimental
description: Detects potential out-of-bounds write attempts in VeloCloud VCMP tunnel protocol by monitoring unusual UDP traffic patterns.
references:
  - https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180
logsource:
  category: network_connection
  product: velocloud
detection:
  selection:
    protocol: udp
    dest_port: 4500
    process_name|contains: # Adjust based on actual process names
      - velocloud
      - vcmp
  timeframe: 5m
  condition: selection | stats count() by SourceIp, DestinationIp, DestinationPort | where count() > 50
falsepositives:
  - Legitimate high-volume VCMP tunnel traffic
level: medium

Elastic ES|QL

from network.flow
| where network.transport == "udp" and destination.port == 4500
| where process.name : ("velocloud", "vcmp") // Adjust based on actual process names
| summarize flow_count = count() by host.name, destination.ip, destination.port, process.name
| where flow_count > 50
| select host.name, destination.ip, destination.port, process.name, flow_count

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen