Versa Networks Versa Director multiple vulnerabilities
Versa Networks Versa Director contains a variety of vulnerabilities. In the most severe cases, a remote, unauthenticated attacker could execute arbitrary code with administrative privileges.
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24291US | — | — | ||
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injectio… | ||||
| CVE-2025-24288US | —OT elevated | — | ||
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) th… | ||||
| CVE-2025-23173US | — | — | ||
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed o… | ||||
| CVE-2025-23172US | — | — | ||
The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" func… | ||||
| CVE-2025-23171US | — | — | ||
The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI ap… | ||||
| CVE-2025-23170US | — | — | ||
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python scr… | ||||
| CVE-2025-23169US | medium6.1 | — | ||
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customiza… | ||||
| CVE-2025-23168US | high8.8 | — | ||
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrus… | ||||
| CVE-2024-45208US | —OT elevated | — | ||
The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange… | ||||
references
External citations — patches, advisories, analysis.
remediations (18)
- No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - No fix availableDirector
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 - FixedDirector
Fixed in 22.1.4 February 8, 2025, and later.
- WorkaroundDirector
Implement manual hardening, see https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Ports_4566.2C_4570.2C_and_5432 and https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediation.
https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan