CVE-2024-45208

criticalpriority · track · 0OT risk · elevatedEPSS 0.009 · 58 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.86% (58th) EPSS

CVSS 9.8 · critical

Is it mine?

22 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_it

EPSS · scored 2026-10-27

The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedDirectorcisa_csaf_it
Fixed in 22.1.4 February 8, 2025, and later.
WorkaroundDirectorcisa_csaf_it
Implement manual hardening, see https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Ports_4566.2C_4570.2C_and_5432 and https://support.versa-networks.com/support/solutions/articles/23000026724-versa-director-ha-port-exploit-discovery-remediation.
https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · support@hackerone.comexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1392USCWE-284USCWE-284USCWE-798US

affected products (22)

Products and version ranges known to be affected.

Versa Director 21.2.2all versionscisa_csaf_itUS
Versa Director 21.2.3all versionscisa_csaf_itUS
Versa Director 22.1.1all versionscisa_csaf_itUS
Versa Director 22.1.2all versionscisa_csaf_itUS
Versa Director 22.1.3all versionscisa_csaf_itUS
Versa Director 22.1.4 February 8, 2025all versionsfixedcisa_csaf_itUS
Versa Director >=22.1.4|<22.1.4 February 8, 2025all versionscisa_csaf_itUS
Versa Directorall versionscisa_csaf_itUS
Versa Directorall versionsfixedcisa_csaf_itUS
Versa Director22.1.4| → 22.1.4 February 8, 2025cisa_csaf_itUS
Versa Director≤ 22.1.4 ≤22.1.4enisa_euvdEU
Versa Director≤ 21.2.2 ≤21.2.2enisa_euvdEU
Versa Director≤ 22.1.2 ≤22.1.2enisa_euvdEU
Versa Director≤ 22.1.1 ≤22.1.1enisa_euvdEU
Versa Director≤ 21.2.3 ≤21.2.3enisa_euvdEU
Versa Director≤ 22.1.3 ≤22.1.3enisa_euvdEU
Versa Networks Versa Director≤ 22.1.4fstec_bduRU
Versa Networks Versa Director≤ 22.1.3fstec_bduRU
Versa Networks Versa Director≤ 22.1.2fstec_bduRU
Versa Networks Versa Director≤ 22.1.1fstec_bduRU

showing 20 of 22

advisories (1)

Vendor and ecosystem advisories describing this.

VA-25-169-01Versa Networks Versa Director multiple vulnerabilities2025-07-02csaf · cisa_csaf_itUS
Versa Networks Versa Director contains a variety of vulnerabilities. In the most severe cases, a remote, unauthenticated attacker could execute arbitrary code with administrative privileges.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_it NVD CVE.org MITRE

published 2025-06-19modified 2026-06-17

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan