CVE-2025-23168

highpriority · track · 35EPSS 0.004 · 34 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.40% (34th) EPSS

CVSS 8.8 · high

Is it mine?

33 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_it

EPSS · scored 2026-10-27

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends that Director be upgraded to one of the remediated software versions.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedDirectorcisa_csaf_it
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715
No fix availableDirectorcisa_csaf_it
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.8

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.15mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · CISA US

v3.16.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · ENISA EU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · support@hackerone.comexploitability 2.8 · impact 3.4

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-290USCWE-290USCWE-307USCWE-307US

affected products (33)

Products and version ranges known to be affected.

Versa Director 21.2.2all versionscisa_csaf_itUS
Versa Director 21.2.3 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.1all versionscisa_csaf_itUS
Versa Director 22.1.2 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.3 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.4 February 8, 2025all versionsfixedcisa_csaf_itUS
Versa Director >=21.2.3|<21.2.3 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.2|<22.1.2 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.3|<22.1.3 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.4|<22.1.4 February 8, 2025all versionscisa_csaf_itUS
Versa Directorall versionsfixedcisa_csaf_itUS
Versa Directorall versionscisa_csaf_itUS
Versa Director21.2.3| → 21.2.3 June 10, 2025cisa_csaf_itUS
Versa Director22.1.2| → 22.1.2 June 10, 2025cisa_csaf_itUS
Versa Director22.1.3| → 22.1.3 June 10, 2025cisa_csaf_itUS
Versa Director22.1.4| → 22.1.4 February 8, 2025cisa_csaf_itUS
Versa Director≤ 22.1.2 ≤22.1.2enisa_euvdEU
Versa Director≤ 22.1.3 ≤22.1.3enisa_euvdEU
Versa Director≤ 21.2.2 ≤21.2.2enisa_euvdEU
Versa Director≤ 22.1.1 ≤22.1.1enisa_euvdEU

showing 20 of 33

advisories (1)

Vendor and ecosystem advisories describing this.

VA-25-169-01Versa Networks Versa Director multiple vulnerabilities2025-07-02csaf · cisa_csaf_itUS
Versa Networks Versa Director contains a variety of vulnerabilities. In the most severe cases, a remote, unauthenticated attacker could execute arbitrary code with administrative privileges.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_it NVD CVE.org MITRE

published 2025-06-19modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan