Search
Find a vulnerability
Search criteria
12 vulnerabilities found for VOS by Versa
CVE-2026-107245 (GCVE-0-2026-107245)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.
Buffer Overflow Vulnerability Description
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS.
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance.
What is impacted?
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable.
What is not impacted?
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.
Severity
No CVSS data available.
CWE
- CWE-121 - Stack Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < 23.1.2 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "23.1.2",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Versa has confirmed a\u202fbuffer overflow\u202fvulnerability\u202fin the\u202fIPsec implementation\u202fon VOS, aka Versa\u202fFlexVNF. \n \n\u202fBuffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE\u202fAuth packet is sent to VOS, the\u202fvsmd\u202fprocess crashes, thereby\u202fresulting in\u202fa Denial of Service.\u202fAn\u202fattacker\u202fcan\u202fcreate\u202fa Denial-of-Service\u202fattack on\u202fthe VOS appliances by\u202fcrafting a\u202fmalicious IKE Auth\u202fpacket and sending it to the\u202fWAN\u202finterfaces on the VOS. \n \nDuring the\u202fIKE\u202fAuthentication\u202fphase, if the IKE SA negotiation fails, and the size of the Remote ID\u202fis\u202flarger than the buffer size used to process the Remote ID,\u202fit will result in a crash of the\u202fvsmd\u202fprocess on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type\u202fcontroller-staging-sdwan\u202for remote-access-server\u202fusing a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are\u202fnot\u202faffected.)\u202fThis configuration typically applies to all\u202fControllers,\u202fHub Controllers, and\u202fSSE Gateways. Additionally,\u202fsite-to-site\u202fVPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.094Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"
}
],
"workarounds": [
{
"lang": "en",
"value": "Disable the\u202fstaging VPN profile\u202fon Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively\u202frequired. Enable the profile only for the duration of device bootstrapping. \n\nFor site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). \n\nIf the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107245",
"datePublished": "2026-11-10T00:32:37.094Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107244 (GCVE-0-2026-107244)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < July 2, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.935Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107244",
"datePublished": "2026-11-10T00:32:36.935Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107243 (GCVE-0-2026-107243)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.888Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the www/web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107243",
"datePublished": "2026-11-10T00:32:36.888Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107242 (GCVE-0-2026-107242)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
No CVSS data available.
CWE
- CWE-340 - Generation of Predictable Numbers or Identifiers
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system\u2019s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user\u2019s session ID could hijack that user\u2019s session.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-340",
"description": "CWE-340 Generation of Predictable Numbers or Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.037Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107242",
"datePublished": "2026-11-10T00:32:37.037Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107241 (GCVE-0-2026-107241)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.938Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\n \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107241",
"datePublished": "2026-11-10T00:32:36.938Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107240 (GCVE-0-2026-107240)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC, Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.066Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af2299bdd1c93ddc0a3e832"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link:\n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107240",
"datePublished": "2026-11-10T00:32:37.066Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107245 (GCVE-0-2026-107245)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.
Buffer Overflow Vulnerability Description
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS.
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance.
What is impacted?
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable.
What is not impacted?
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.
Severity
No CVSS data available.
CWE
- CWE-121 - Stack Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < 23.1.2 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "23.1.2",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Versa has confirmed a\u202fbuffer overflow\u202fvulnerability\u202fin the\u202fIPsec implementation\u202fon VOS, aka Versa\u202fFlexVNF. \n \n\u202fBuffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE\u202fAuth packet is sent to VOS, the\u202fvsmd\u202fprocess crashes, thereby\u202fresulting in\u202fa Denial of Service.\u202fAn\u202fattacker\u202fcan\u202fcreate\u202fa Denial-of-Service\u202fattack on\u202fthe VOS appliances by\u202fcrafting a\u202fmalicious IKE Auth\u202fpacket and sending it to the\u202fWAN\u202finterfaces on the VOS. \n \nDuring the\u202fIKE\u202fAuthentication\u202fphase, if the IKE SA negotiation fails, and the size of the Remote ID\u202fis\u202flarger than the buffer size used to process the Remote ID,\u202fit will result in a crash of the\u202fvsmd\u202fprocess on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type\u202fcontroller-staging-sdwan\u202for remote-access-server\u202fusing a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are\u202fnot\u202faffected.)\u202fThis configuration typically applies to all\u202fControllers,\u202fHub Controllers, and\u202fSSE Gateways. Additionally,\u202fsite-to-site\u202fVPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.094Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"
}
],
"workarounds": [
{
"lang": "en",
"value": "Disable the\u202fstaging VPN profile\u202fon Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively\u202frequired. Enable the profile only for the duration of device bootstrapping. \n\nFor site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). \n\nIf the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107245",
"datePublished": "2026-11-10T00:32:37.094Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107240 (GCVE-0-2026-107240)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC, Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.066Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af2299bdd1c93ddc0a3e832"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link:\n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107240",
"datePublished": "2026-11-10T00:32:37.066Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107242 (GCVE-0-2026-107242)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
No CVSS data available.
CWE
- CWE-340 - Generation of Predictable Numbers or Identifiers
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system\u2019s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user\u2019s session ID could hijack that user\u2019s session.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-340",
"description": "CWE-340 Generation of Predictable Numbers or Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.037Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107242",
"datePublished": "2026-11-10T00:32:37.037Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107241 (GCVE-0-2026-107241)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.938Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\n \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107241",
"datePublished": "2026-11-10T00:32:36.938Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107244 (GCVE-0-2026-107244)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < July 2, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.935Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107244",
"datePublished": "2026-11-10T00:32:36.935Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107243 (GCVE-0-2026-107243)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.888Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the www/web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107243",
"datePublished": "2026-11-10T00:32:36.888Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}