Search
Find a vulnerability
Search criteria
42 vulnerabilities by versa
CVE-2026-107245 (GCVE-0-2026-107245)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.
Buffer Overflow Vulnerability Description
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS.
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance.
What is impacted?
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable.
What is not impacted?
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.
Severity
No CVSS data available.
CWE
- CWE-121 - Stack Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < 23.1.2 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "23.1.2",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Versa has confirmed a\u202fbuffer overflow\u202fvulnerability\u202fin the\u202fIPsec implementation\u202fon VOS, aka Versa\u202fFlexVNF. \n \n\u202fBuffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE\u202fAuth packet is sent to VOS, the\u202fvsmd\u202fprocess crashes, thereby\u202fresulting in\u202fa Denial of Service.\u202fAn\u202fattacker\u202fcan\u202fcreate\u202fa Denial-of-Service\u202fattack on\u202fthe VOS appliances by\u202fcrafting a\u202fmalicious IKE Auth\u202fpacket and sending it to the\u202fWAN\u202finterfaces on the VOS. \n \nDuring the\u202fIKE\u202fAuthentication\u202fphase, if the IKE SA negotiation fails, and the size of the Remote ID\u202fis\u202flarger than the buffer size used to process the Remote ID,\u202fit will result in a crash of the\u202fvsmd\u202fprocess on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type\u202fcontroller-staging-sdwan\u202for remote-access-server\u202fusing a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are\u202fnot\u202faffected.)\u202fThis configuration typically applies to all\u202fControllers,\u202fHub Controllers, and\u202fSSE Gateways. Additionally,\u202fsite-to-site\u202fVPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.094Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"
}
],
"workarounds": [
{
"lang": "en",
"value": "Disable the\u202fstaging VPN profile\u202fon Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively\u202frequired. Enable the profile only for the duration of device bootstrapping. \n\nFor site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). \n\nIf the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107245",
"datePublished": "2026-11-10T00:32:37.094Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107244 (GCVE-0-2026-107244)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < July 2, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.935Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107244",
"datePublished": "2026-11-10T00:32:36.935Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107243 (GCVE-0-2026-107243)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.888Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the www/web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107243",
"datePublished": "2026-11-10T00:32:36.888Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107242 (GCVE-0-2026-107242)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
No CVSS data available.
CWE
- CWE-340 - Generation of Predictable Numbers or Identifiers
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system\u2019s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user\u2019s session ID could hijack that user\u2019s session.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-340",
"description": "CWE-340 Generation of Predictable Numbers or Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.037Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107242",
"datePublished": "2026-11-10T00:32:37.037Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107241 (GCVE-0-2026-107241)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.938Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\n \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107241",
"datePublished": "2026-11-10T00:32:36.938Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107240 (GCVE-0-2026-107240)
Vulnerability from nvd – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC, Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.066Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af2299bdd1c93ddc0a3e832"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link:\n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107240",
"datePublished": "2026-11-10T00:32:37.066Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24291 (GCVE-0-2025-24291)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation, allowing the upload of arbitrary file types. This flaw can be exploited to place a malicious file on disk.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:48.843611Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:49.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation, allowing the upload of arbitrary file types. This flaw can be exploited to place a malicious file on disk. \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:54.681Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526fc6dc94d6b9f2faf71d"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24291",
"datePublished": "2025-06-18T23:30:54.681Z",
"dateReserved": "2025-01-17T01:00:07.458Z",
"dateUpdated": "2025-06-23T16:04:49.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24288 (GCVE-0-2025-24288)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Versa recommends the following security controls:
1) Change default passwords to complex passwords
2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character
3) Passwords must be changed at least every 90 days
4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password.
5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:47 UTC
CWE
- CWE-1188 - Initialization of a Resource with an Insecure Default
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:47:27.582046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:43.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services.\r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nVersa recommends the following security controls:\r\n\r\n1) Change default passwords to complex passwords\r\n2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character\r\n3) Passwords must be changed at least every 90 days\r\n4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password.\r\n5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:55.344Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526d12dc94d6b9f2faf719"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24288",
"datePublished": "2025-06-18T23:30:55.344Z",
"dateReserved": "2025-01-17T01:00:07.457Z",
"dateUpdated": "2025-06-23T16:04:43.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23173 (GCVE-0-2025-23173)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Restrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:49 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:49:07.215724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:30.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution. \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nRestrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:50.570Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526ee0dc94d6b9f2faf71c"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23173",
"datePublished": "2025-06-18T23:30:50.570Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:30.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23172 (GCVE-0-2025-23172)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:55.286324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:24.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the \"Add Webhook\" and \"Test Webhook\" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. \r\n \r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:51.224Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526e7bdc94d6b9f2faf71b"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23172",
"datePublished": "2025-06-18T23:30:51.224Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:24.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23171 (GCVE-0-2025-23171)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:50.891381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:01.399Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:53.336Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526dbbdc94d6b9f2faf71a"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23171",
"datePublished": "2025-06-18T23:30:53.336Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:01.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23170 (GCVE-0-2025-23170)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:59.393412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:43.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:49.238Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526bc7dc94d6b9f2faf717"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23170",
"datePublished": "2025-06-18T23:30:49.238Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:43.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23169 (GCVE-0-2025-23169)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:57.350783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:37.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:49.907Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526a08dc94d6b9f2faf716"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23169",
"datePublished": "2025-06-18T23:30:49.907Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:37.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23168 (GCVE-0-2025-23168)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:43 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:43:12.464928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:08.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nVersa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:52.692Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23168",
"datePublished": "2025-06-18T23:30:52.692Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:08.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45208 (GCVE-0-2024-45208)
Vulnerability from nvd – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:54 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
7 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:54:05.315403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:55.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.\r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:53.998Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediation"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
},
{
"url": "https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Port_4566"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-45208",
"datePublished": "2025-06-18T23:30:53.998Z",
"dateReserved": "2024-08-23T01:00:01.061Z",
"dateUpdated": "2025-06-23T16:04:55.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-107245 (GCVE-0-2026-107245)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.
Buffer Overflow Vulnerability Description
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS.
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance.
What is impacted?
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable.
What is not impacted?
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.
Severity
No CVSS data available.
CWE
- CWE-121 - Stack Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < 23.1.2 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "23.1.2",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Versa has confirmed a\u202fbuffer overflow\u202fvulnerability\u202fin the\u202fIPsec implementation\u202fon VOS, aka Versa\u202fFlexVNF. \n \n\u202fBuffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE\u202fAuth packet is sent to VOS, the\u202fvsmd\u202fprocess crashes, thereby\u202fresulting in\u202fa Denial of Service.\u202fAn\u202fattacker\u202fcan\u202fcreate\u202fa Denial-of-Service\u202fattack on\u202fthe VOS appliances by\u202fcrafting a\u202fmalicious IKE Auth\u202fpacket and sending it to the\u202fWAN\u202finterfaces on the VOS. \n \nDuring the\u202fIKE\u202fAuthentication\u202fphase, if the IKE SA negotiation fails, and the size of the Remote ID\u202fis\u202flarger than the buffer size used to process the Remote ID,\u202fit will result in a crash of the\u202fvsmd\u202fprocess on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type\u202fcontroller-staging-sdwan\u202for remote-access-server\u202fusing a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are\u202fnot\u202faffected.)\u202fThis configuration typically applies to all\u202fControllers,\u202fHub Controllers, and\u202fSSE Gateways. Additionally,\u202fsite-to-site\u202fVPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.094Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"
}
],
"workarounds": [
{
"lang": "en",
"value": "Disable the\u202fstaging VPN profile\u202fon Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively\u202frequired. Enable the profile only for the duration of device bootstrapping. \n\nFor site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). \n\nIf the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107245",
"datePublished": "2026-11-10T00:32:37.094Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107240 (GCVE-0-2026-107240)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC, Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.066Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af2299bdd1c93ddc0a3e832"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link:\n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107240",
"datePublished": "2026-11-10T00:32:37.066Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107242 (GCVE-0-2026-107242)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
No CVSS data available.
CWE
- CWE-340 - Generation of Predictable Numbers or Identifiers
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system\u2019s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user\u2019s session ID could hijack that user\u2019s session.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-340",
"description": "CWE-340 Generation of Predictable Numbers or Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.037Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107242",
"datePublished": "2026-11-10T00:32:37.037Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107241 (GCVE-0-2026-107241)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.938Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\n \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107241",
"datePublished": "2026-11-10T00:32:36.938Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107244 (GCVE-0-2026-107244)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < July 2, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.935Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107244",
"datePublished": "2026-11-10T00:32:36.935Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107243 (GCVE-0-2026-107243)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.888Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the www/web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107243",
"datePublished": "2026-11-10T00:32:36.888Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24288 (GCVE-0-2025-24288)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Versa recommends the following security controls:
1) Change default passwords to complex passwords
2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character
3) Passwords must be changed at least every 90 days
4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password.
5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:47 UTC
CWE
- CWE-1188 - Initialization of a Resource with an Insecure Default
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:47:27.582046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:43.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services.\r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nVersa recommends the following security controls:\r\n\r\n1) Change default passwords to complex passwords\r\n2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character\r\n3) Passwords must be changed at least every 90 days\r\n4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password.\r\n5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:55.344Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526d12dc94d6b9f2faf719"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24288",
"datePublished": "2025-06-18T23:30:55.344Z",
"dateReserved": "2025-01-17T01:00:07.457Z",
"dateUpdated": "2025-06-23T16:04:43.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24291 (GCVE-0-2025-24291)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation, allowing the upload of arbitrary file types. This flaw can be exploited to place a malicious file on disk.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:48.843611Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:49.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation, allowing the upload of arbitrary file types. This flaw can be exploited to place a malicious file on disk. \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:54.681Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526fc6dc94d6b9f2faf71d"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24291",
"datePublished": "2025-06-18T23:30:54.681Z",
"dateReserved": "2025-01-17T01:00:07.458Z",
"dateUpdated": "2025-06-23T16:04:49.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45208 (GCVE-0-2024-45208)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:54 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
7 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:54:05.315403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:55.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.\r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:53.998Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediation"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
},
{
"url": "https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Port_4566"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-45208",
"datePublished": "2025-06-18T23:30:53.998Z",
"dateReserved": "2024-08-23T01:00:01.061Z",
"dateUpdated": "2025-06-23T16:04:55.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23171 (GCVE-0-2025-23171)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:50.891381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:01.399Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:53.336Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526dbbdc94d6b9f2faf71a"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23171",
"datePublished": "2025-06-18T23:30:53.336Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:01.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23168 (GCVE-0-2025-23168)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:43 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:43:12.464928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:08.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nVersa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:52.692Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23168",
"datePublished": "2025-06-18T23:30:52.692Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:08.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23172 (GCVE-0-2025-23172)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:55.286324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:24.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the \"Add Webhook\" and \"Test Webhook\" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. \r\n \r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:51.224Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526e7bdc94d6b9f2faf71b"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23172",
"datePublished": "2025-06-18T23:30:51.224Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:24.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23173 (GCVE-0-2025-23173)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Restrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:49 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:49:07.215724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:30.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution. \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nRestrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:50.570Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526ee0dc94d6b9f2faf71c"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23173",
"datePublished": "2025-06-18T23:30:50.570Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:30.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23169 (GCVE-0-2025-23169)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:57.350783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:37.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:49.907Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526a08dc94d6b9f2faf716"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23169",
"datePublished": "2025-06-18T23:30:49.907Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:37.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23170 (GCVE-0-2025-23170)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:59.393412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:43.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:49.238Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526bc7dc94d6b9f2faf717"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23170",
"datePublished": "2025-06-18T23:30:49.238Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:43.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}