Search
Find a vulnerability
Search criteria
21 vulnerabilities by versa
CVE-2026-107245 (GCVE-0-2026-107245)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.
Buffer Overflow Vulnerability Description
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS.
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance.
What is impacted?
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable.
What is not impacted?
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.
Severity
No CVSS data available.
CWE
- CWE-121 - Stack Overflow
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < 23.1.2 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "23.1.2",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Versa has confirmed a\u202fbuffer overflow\u202fvulnerability\u202fin the\u202fIPsec implementation\u202fon VOS, aka Versa\u202fFlexVNF. \n \n\u202fBuffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE\u202fAuth packet is sent to VOS, the\u202fvsmd\u202fprocess crashes, thereby\u202fresulting in\u202fa Denial of Service.\u202fAn\u202fattacker\u202fcan\u202fcreate\u202fa Denial-of-Service\u202fattack on\u202fthe VOS appliances by\u202fcrafting a\u202fmalicious IKE Auth\u202fpacket and sending it to the\u202fWAN\u202finterfaces on the VOS. \n \nDuring the\u202fIKE\u202fAuthentication\u202fphase, if the IKE SA negotiation fails, and the size of the Remote ID\u202fis\u202flarger than the buffer size used to process the Remote ID,\u202fit will result in a crash of the\u202fvsmd\u202fprocess on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type\u202fcontroller-staging-sdwan\u202for remote-access-server\u202fusing a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are\u202fnot\u202faffected.)\u202fThis configuration typically applies to all\u202fControllers,\u202fHub Controllers, and\u202fSSE Gateways. Additionally,\u202fsite-to-site\u202fVPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.094Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"
}
],
"workarounds": [
{
"lang": "en",
"value": "Disable the\u202fstaging VPN profile\u202fon Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively\u202frequired. Enable the profile only for the duration of device bootstrapping. \n\nFor site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). \n\nIf the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107245",
"datePublished": "2026-11-10T00:32:37.094Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107240 (GCVE-0-2026-107240)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC, Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.066Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af2299bdd1c93ddc0a3e832"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link:\n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107240",
"datePublished": "2026-11-10T00:32:37.066Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107242 (GCVE-0-2026-107242)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
No CVSS data available.
CWE
- CWE-340 - Generation of Predictable Numbers or Identifiers
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system\u2019s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user\u2019s session ID could hijack that user\u2019s session.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-340",
"description": "CWE-340 Generation of Predictable Numbers or Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:37.037Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107242",
"datePublished": "2026-11-10T00:32:37.037Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:37.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107241 (GCVE-0-2026-107241)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCSC Netherlands"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.938Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\n \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107241",
"datePublished": "2026-11-10T00:32:36.938Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107244 (GCVE-0-2026-107244)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-1390 - Weak Authentication
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < July 2, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390 Weak Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.935Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107244",
"datePublished": "2026-11-10T00:32:36.935Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107243 (GCVE-0-2026-107243)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
EPSS
VEX
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
hackerone
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | VOS |
Affected:
21.1.1 , ≤ 21.2.3
(semver)
Affected: 22.1.2 , < July 2, 2026 (semver) Affected: 22.1.3 , < July 2, 2026 (semver) Affected: 22.1.4 , < July 2, 2026 (semver) Affected: 23.1.2 , < Aug 3, 2026 (semver) Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver) Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver) Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver) Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver) |
{
"containers": {
"cna": {
"affected": [
{
"product": "VOS",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.1.1",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThan": "July 2, 2026",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
},
{
"lessThan": "Aug 3, 2026",
"status": "affected",
"version": "23.1.2",
"versionType": "semver"
},
{
"lessThan": "22.1.2 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.2 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.3 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.3 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "22.1.4 July-2-2026-Hotfix",
"status": "unaffected",
"version": "22.1.4 July-2-2026-Hotfix",
"versionType": "semver"
},
{
"lessThan": "23.1.2 Aug-3-2026-Hotfix",
"status": "unaffected",
"version": "23.1.2 Aug-3-2026-Hotfix",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Microsoft"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:32:36.888Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838"
}
],
"workarounds": [
{
"lang": "en",
"value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the www/web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-107243",
"datePublished": "2026-11-10T00:32:36.888Z",
"dateReserved": "2026-10-07T15:00:00.550Z",
"dateUpdated": "2026-11-10T00:32:36.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24288 (GCVE-0-2025-24288)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Versa recommends the following security controls:
1) Change default passwords to complex passwords
2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character
3) Passwords must be changed at least every 90 days
4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password.
5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:47 UTC
CWE
- CWE-1188 - Initialization of a Resource with an Insecure Default
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:47:27.582046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:43.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services.\r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nVersa recommends the following security controls:\r\n\r\n1) Change default passwords to complex passwords\r\n2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character\r\n3) Passwords must be changed at least every 90 days\r\n4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password.\r\n5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:55.344Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526d12dc94d6b9f2faf719"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24288",
"datePublished": "2025-06-18T23:30:55.344Z",
"dateReserved": "2025-01-17T01:00:07.457Z",
"dateUpdated": "2025-06-23T16:04:43.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-24291 (GCVE-0-2025-24291)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation, allowing the upload of arbitrary file types. This flaw can be exploited to place a malicious file on disk.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:48.843611Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:49.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By appending additional arguments to the file name, an attacker can bypass MIME type validation, allowing the upload of arbitrary file types. This flaw can be exploited to place a malicious file on disk. \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:54.681Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526fc6dc94d6b9f2faf71d"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24291",
"datePublished": "2025-06-18T23:30:54.681Z",
"dateReserved": "2025-01-17T01:00:07.458Z",
"dateUpdated": "2025-06-23T16:04:49.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45208 (GCVE-0-2024-45208)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:04
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:54 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
hackerone
CNA
References
7 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:54:05.315403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:04:55.377Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.\r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:53.998Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediation"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
},
{
"url": "https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Port_4566"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-45208",
"datePublished": "2025-06-18T23:30:53.998Z",
"dateReserved": "2024-08-23T01:00:01.061Z",
"dateUpdated": "2025-06-23T16:04:55.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23171 (GCVE-0-2025-23171)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:50.891381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:01.399Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:53.336Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526dbbdc94d6b9f2faf71a"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23171",
"datePublished": "2025-06-18T23:30:53.336Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:01.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23168 (GCVE-0-2025-23168)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:43 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:43:12.464928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:08.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nVersa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:52.692Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23168",
"datePublished": "2025-06-18T23:30:52.692Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:08.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23172 (GCVE-0-2025-23172)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23172",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:55.286324Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:24.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the \"Add Webhook\" and \"Test Webhook\" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. \r\n \r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:51.224Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526e7bdc94d6b9f2faf71b"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23172",
"datePublished": "2025-06-18T23:30:51.224Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:24.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23173 (GCVE-0-2025-23173)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Restrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:49 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:49:07.215724Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:30.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution. \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nRestrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:50.570Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526ee0dc94d6b9f2faf71c"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23173",
"datePublished": "2025-06-18T23:30:50.570Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:30.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23169 (GCVE-0-2025-23169)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:57.350783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:37.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:49.907Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526a08dc94d6b9f2faf716"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23169",
"datePublished": "2025-06-18T23:30:49.907Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:37.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-23170 (GCVE-0-2025-23170)
Vulnerability from cvelistv5 – Published: 2025-06-18 23:30 – Updated: 2025-06-23 16:05
VLAI
EPSS
VEX
Summary
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system.
Exploitation Status:
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-23 15:45 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
hackerone
CNA
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-23170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T15:45:59.393412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T16:05:43.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.2",
"status": "affected",
"version": "22.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.3",
"status": "affected",
"version": "22.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. \r\n\r\nExploitation Status: \r\n\r\nVersa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. \r\n\r\nWorkarounds or Mitigation: \r\n\r\nThere are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T23:30:49.238Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/68526bc7dc94d6b9f2faf717"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2"
},
{
"url": "https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-23170",
"datePublished": "2025-06-18T23:30:49.238Z",
"dateReserved": "2025-01-12T01:00:00.649Z",
"dateUpdated": "2025-06-23T16:05:43.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-34025 (GCVE-0-2025-34025)
Vulnerability from cvelistv5 – Published: 2025-05-21 22:11 – Updated: 2026-02-26 18:27
VLAI
EPSS
VEX
Title
Versa Concerto Insecure Docker Mount Container Escape
Summary
The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting of host binary paths that allow the container to modify host paths. The escape can be used to trigger remote code execution or direct host access depending on the host operating system configuration.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-28 03:56 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
VulnCheck
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://projectdiscovery.io/blog/versa-concerto-a… | exploitmitigation |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-34025",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T03:56:03.941700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:27:57.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"web-service Container"
],
"product": "Concerto",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "12.2.0",
"status": "affected",
"version": "12.1.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:versa:concerto:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.2.0",
"versionStartIncluding": "12.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "sponsor",
"value": "ProjectDiscovery"
},
{
"lang": "en",
"type": "finder",
"value": "Harsh Jaiswal"
},
{
"lang": "en",
"type": "finder",
"value": "Rahul Maini"
},
{
"lang": "en",
"type": "finder",
"value": "Parth Malhotra"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting of host binary paths that allow the container to modify host paths. The escape can be used to trigger remote code execution or direct host access depending on the host operating system configuration.\u003cp\u003eThis issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.\u003c/p\u003e"
}
],
"value": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting of host binary paths that allow the container to modify host paths. The escape can be used to trigger remote code execution or direct host access depending on the host operating system configuration.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable."
}
],
"impacts": [
{
"capecId": "CAPEC-480",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-480 Escaping Virtualization"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-28T19:43:04.692Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"mitigation"
],
"url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Versa Concerto Insecure Docker Mount Container Escape",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-34025",
"datePublished": "2025-05-21T22:11:32.081Z",
"dateReserved": "2025-04-15T19:15:22.545Z",
"dateUpdated": "2026-02-26T18:27:57.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-34026 (GCVE-0-2025-34026)
Vulnerability from cvelistv5 – Published: 2025-05-21 22:04 – Updated: 2026-01-23 14:34
VLAI
EPSS
VEX
Title
Versa Concerto Actuator Authentication Bypass Information Leak
Summary
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Severity
SSVC
Exploitation: active
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-23 14:34 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://projectdiscovery.io/blog/versa-concerto-a… | exploitmitigation |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
| https://security-portal.versa-networks.com/emailb… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-34026",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-23T14:34:03.184960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-01-22",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-23T14:34:06.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"Traefik"
],
"product": "Concerto",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "12.2.0",
"status": "affected",
"version": "12.1.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:versa:concerto:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.2.0",
"versionStartIncluding": "12.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "sponsor",
"value": "ProjectDiscovery"
},
{
"lang": "en",
"type": "finder",
"value": "Harsh Jaiswal"
},
{
"lang": "en",
"type": "finder",
"value": "Rahul Maini"
},
{
"lang": "en",
"type": "finder",
"value": "Parth Malhotra"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.\u003cp\u003eThis issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.\u003c/p\u003e"
}
],
"value": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable."
}
],
"impacts": [
{
"capecId": "CAPEC-131",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-131 Resource Leak Exposure"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-28T19:42:27.561Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"mitigation"
],
"url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Versa Concerto Actuator Authentication Bypass Information Leak",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-34026",
"datePublished": "2025-05-21T22:04:58.832Z",
"dateReserved": "2025-04-15T19:15:22.545Z",
"dateUpdated": "2026-01-23T14:34:06.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-34027 (GCVE-0-2025-34027)
Vulnerability from cvelistv5 – Published: 2025-05-21 21:58 – Updated: 2026-02-26 18:27
VLAI
EPSS
VEX
Title
Versa Concerto Authentication Bypass File Write Remote Code Execution
Summary
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-28 03:56 UTC
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
VulnCheck
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://projectdiscovery.io/blog/versa-concerto-a… | exploitmitigation |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-34027",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T03:56:05.405556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:27:59.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"Traefik"
],
"product": "Concerto",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "12.2.0",
"status": "affected",
"version": "12.1.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:versa:concerto:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.2.0",
"versionStartIncluding": "12.1.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "sponsor",
"value": "ProjectDiscovery"
},
{
"lang": "en",
"type": "finder",
"value": "Harsh Jaiswal"
},
{
"lang": "en",
"type": "finder",
"value": "Rahul Maini"
},
{
"lang": "en",
"type": "finder",
"value": "Parth Malhotra"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).\u003cp\u003eThis issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.\u003c/p\u003e"
}
],
"value": "The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable."
}
],
"impacts": [
{
"capecId": "CAPEC-38",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-38 Leveraging/Manipulating Configuration File Search Paths"
}
]
},
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-28T19:43:34.727Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"mitigation"
],
"url": "https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Versa Concerto Authentication Bypass File Write Remote Code Execution",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-34027",
"datePublished": "2025-05-21T21:58:31.698Z",
"dateReserved": "2025-04-15T19:15:22.545Z",
"dateUpdated": "2026-02-26T18:27:59.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-42450 (GCVE-0-2024-42450)
Vulnerability from cvelistv5 – Published: 2024-11-19 17:21 – Updated: 2024-11-21 04:55
VLAI
EPSS
VEX
Summary
The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres to listen on all network interfaces. This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system.
Exploitation Status:
Versa Networks is not aware of this exploitation in any production systems. A proof of concept exists in the lab environment.
Workarounds or Mitigation:
Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors. For older releases, Versa recommends performing manual hardening of HA ports. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports
This vulnerability is not exploitable on Versa Directors if published Firewall guidelines are implemented. We have validated that no Versa-hosted head ends have been affected by this vulnerability. All Versa-hosted head ends are patched and hardened.
Please contact Versa Technical Support or Versa account team for any further assistance.
Software Download Links:
22.1.4: https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4
Severity
10 (Critical)
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-20 00:00 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:versa:director:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "director",
"vendor": "versa",
"versions": [
{
"lessThanOrEqual": "21.2.3",
"status": "affected",
"version": "21.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.1",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-42450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T04:55:12.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "22.1.4",
"status": "affected",
"version": "22.1.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres to listen on all network interfaces. This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system. \n\nExploitation Status:\nVersa Networks is not aware of this exploitation in any production systems. A proof of concept exists in the lab environment.\n\nWorkarounds or Mitigation:\nStarting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors. For older releases, Versa recommends performing manual hardening of HA ports. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports \n\nThis vulnerability is not exploitable on Versa Directors if published Firewall guidelines are implemented. We have validated that no Versa-hosted head ends have been affected by this vulnerability. All Versa-hosted head ends are patched and hardened. \n\nPlease contact Versa Technical Support or Versa account team for any further assistance.\n\nSoftware Download Links:\n22.1.4: https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T17:21:41.498Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-42450",
"datePublished": "2024-11-19T17:21:41.498Z",
"dateReserved": "2024-08-02T01:04:07.984Z",
"dateUpdated": "2024-11-21T04:55:12.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-45229 (GCVE-0-2024-45229)
Vulnerability from cvelistv5 – Published: 2024-09-20 18:09 – Updated: 2024-09-20 18:53
VLAI
EPSS
VEX
Summary
The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information.
Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/* (on ports 9182 & 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-20 18:45 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
hackerone
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | Director |
Affected:
22.1.4 20240909 , < 22.1.4 20240909
(custom)
Affected: 22.1.3 20240909 , < 22.1.3 20240909 (custom) Affected: 22.1.2 20240909 , < 22.1.2 20240909 (custom) Affected: 22.1.1 20240909 , < 22.1.1 20240909 (custom) Affected: 21.2.3 20240909 , < 21.2.3 20240909 (custom) Affected: 21.2.2 20240909 , < 21.2.2 20240909 (custom) |
|
| versa | director |
Affected:
22.1.4
Affected: 22.1.3 Affected: 22.1.2 Affected: 22.1.1 Affected: 21.2.3 Affected: 21.2.2 cpe:2.3:a:versa:director:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:versa:director:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "director",
"vendor": "versa",
"versions": [
{
"status": "affected",
"version": "22.1.4"
},
{
"status": "affected",
"version": "22.1.3"
},
{
"status": "affected",
"version": "22.1.2"
},
{
"status": "affected",
"version": "22.1.1"
},
{
"status": "affected",
"version": "21.2.3"
},
{
"status": "affected",
"version": "21.2.2"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-20T18:45:34.826535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T18:53:08.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThan": "22.1.4 20240909",
"status": "affected",
"version": "22.1.4 20240909",
"versionType": "custom"
},
{
"lessThan": "22.1.3 20240909",
"status": "affected",
"version": "22.1.3 20240909",
"versionType": "custom"
},
{
"lessThan": "22.1.2 20240909",
"status": "affected",
"version": "22.1.2 20240909",
"versionType": "custom"
},
{
"lessThan": "22.1.1 20240909",
"status": "affected",
"version": "22.1.1 20240909",
"versionType": "custom"
},
{
"lessThan": "21.2.3 20240909",
"status": "affected",
"version": "21.2.3 20240909",
"versionType": "custom"
},
{
"lessThan": "21.2.2 20240909",
"status": "affected",
"version": "21.2.2 20240909",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. \r\n\r\nCurrently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/* (on ports 9182 \u0026 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-20T18:09:30.570Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://security-portal.versa-networks.com/emailbulletins/66e4a8ebda545d61ec2b1ab9"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-45229",
"datePublished": "2024-09-20T18:09:30.570Z",
"dateReserved": "2024-08-24T01:00:01.733Z",
"dateUpdated": "2024-09-20T18:53:08.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-39717 (GCVE-0-2024-39717)
Vulnerability from cvelistv5 – Published: 2024-08-22 18:47 – Updated: 2025-10-21 22:55
VLAI
EPSS
VEX
Summary
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
Severity
6.6 (Medium)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-04 03:55 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
hackerone
CNA
References
2 references
| URL | Tags |
|---|---|
| https://versa-networks.com/blog/versa-security-bu… | |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Versa | Director |
Affected:
21.2.2 , ≤ 21.2.2
(custom)
Affected: 21.2.3 before 2024-06-21 , < 21.2.3 before 2024-06-21 (custom) Affected: 22.1.1 , ≤ 22.1.1 (custom) Affected: 22.1.2 before 2024-06-21 , ≤ 22.1.2 before 2024-06-21 (custom) Affected: 22.1.3 before 2024-06-21 , ≤ 22.1.3 before 2024-06-21 (custom) |
|
| versa-networks | versa_director |
Affected:
21.2.2
Affected: 21.2.3 , < 21.2.3_2024-06-21 (custom) Affected: 22.1.1 Affected: 22.1.2 , < 22.1.2_2024-06-21 (custom) Affected: 22.1.3 , < 22.1.3_2024-06-21 (custom) cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "versa_director",
"vendor": "versa-networks",
"versions": [
{
"status": "affected",
"version": "21.2.2"
},
{
"lessThan": "21.2.3_2024-06-21",
"status": "affected",
"version": "21.2.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "22.1.1"
},
{
"lessThan": "22.1.2_2024-06-21",
"status": "affected",
"version": "22.1.2",
"versionType": "custom"
},
{
"lessThan": "22.1.3_2024-06-21",
"status": "affected",
"version": "22.1.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "versa_director",
"vendor": "versa-networks",
"versions": [
{
"status": "affected",
"version": "21.2.2"
},
{
"lessThan": "21.2.3_2024-06-21",
"status": "affected",
"version": "21.2.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "22.1.1"
},
{
"lessThan": "22.1.2_2024-06-21",
"status": "affected",
"version": "22.1.2",
"versionType": "custom"
},
{
"lessThan": "22.1.3_2024-06-21",
"status": "affected",
"version": "22.1.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "versa_director",
"vendor": "versa-networks",
"versions": [
{
"status": "affected",
"version": "21.2.2"
},
{
"lessThan": "21.2.3_2024-06-21",
"status": "affected",
"version": "21.2.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "22.1.1"
},
{
"lessThan": "22.1.2_2024-06-21",
"status": "affected",
"version": "22.1.2",
"versionType": "custom"
},
{
"lessThan": "22.1.3_2024-06-21",
"status": "affected",
"version": "22.1.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "versa_director",
"vendor": "versa-networks",
"versions": [
{
"status": "affected",
"version": "21.2.2"
},
{
"lessThan": "21.2.3_2024-06-21",
"status": "affected",
"version": "21.2.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "22.1.1"
},
{
"lessThan": "22.1.2_2024-06-21",
"status": "affected",
"version": "22.1.2",
"versionType": "custom"
},
{
"lessThan": "22.1.3_2024-06-21",
"status": "affected",
"version": "22.1.3",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "versa_director",
"vendor": "versa-networks",
"versions": [
{
"status": "affected",
"version": "21.2.2"
},
{
"lessThan": "21.2.3_2024-06-21",
"status": "affected",
"version": "21.2.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "22.1.1"
},
{
"lessThan": "22.1.2_2024-06-21",
"status": "affected",
"version": "22.1.2",
"versionType": "custom"
},
{
"lessThan": "22.1.3_2024-06-21",
"status": "affected",
"version": "22.1.3",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39717",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-04T03:55:40.372703Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-08-23",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39717"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:55:46.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39717"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-23T00:00:00.000Z",
"value": "CVE-2024-39717 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Director",
"vendor": "Versa",
"versions": [
{
"lessThanOrEqual": "21.2.2",
"status": "affected",
"version": "21.2.2",
"versionType": "custom"
},
{
"lessThan": "21.2.3 before 2024-06-21",
"status": "affected",
"version": "21.2.3 before 2024-06-21",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.1",
"status": "affected",
"version": "22.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.2 before 2024-06-21",
"status": "affected",
"version": "22.1.2 before 2024-06-21",
"versionType": "custom"
},
{
"lessThanOrEqual": "22.1.3 before 2024-06-21",
"status": "affected",
"version": "22.1.3 before 2024-06-21",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The \u201cChange Favicon\u201d (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T15:49:41.227Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-39717",
"datePublished": "2024-08-22T18:47:12.171Z",
"dateReserved": "2024-06-28T01:04:08.821Z",
"dateUpdated": "2025-10-21T22:55:46.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}