CVE-2024-45208
criticalPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.009 · 58. PerzentilEURUUSEPSS · bewertet 2026-10-27
The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenDirectorcisa_csaf_it
Fixed in 22.1.4 February 8, 2025, and later.
- WorkaroundDirectorcisa_csaf_it
Implement manual hardening, see https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Ports_4566.2C_4570.2C_and_5432 and https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediation.
https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (22)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- VA-25-169-01Versa Networks Versa Director multiple vulnerabilities2025-07-02csaf · cisa_csaf_itUS
Versa Networks Versa Director contains a variety of vulnerabilities. In the most severe cases, a remote, unauthenticated attacker could execute arbitrary code with administrative privileges.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (16)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2024-45208cnnvd
- https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediationPatchcnnvd
- https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Port_4566enisa_euvd
- https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718enisa_euvd
- https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3enisa_euvd
- https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2enisa_euvd
- https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3enisa_euvd
- https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan