Versa Networks Versa Director insecure default PostgreSQL configuration
Versa Networks Versa Director, by default, configures PostgreSQL to listen on all network interfaces using database credentials shared by multiple installations. From [Advising Vulnerability In Versa Director](https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3): "This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system.... Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors." The advisory does not directly address the "...common password across all instances of Versa Director."
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-42450US | —OT elevated | — | ||
The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default confi… | ||||
references
External citations — patches, advisories, analysis.
remediations (1)
- FixedVersa Networks Versa Director 0 < 22.1.4 2024-11-11 Hot Fix
From: [Advising Vulnerability In Versa Director](https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3): "Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors." The advisory does not directly address the "...common password across all instances of Versa Director."
https://security-portal.versa-networks.com/emailbulletins/6735a300415abb89e9a8a9d3
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan