CVE-2025-23170

mediumpriority · track · 0EPSS 0.006 · 48 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.59% (48th) EPSS

CVSS 6.7 · medium

Is it mine?

34 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_it

EPSS · scored 2026-10-27

The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedDirectorcisa_csaf_it
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715
No fix availableDirectorcisa_csaf_it
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715

cvss

Technical severity, 0–10. One row per scoring source.

6.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.16.7mediumAV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · support@hackerone.comexploitability 0.8 · impact 5.9

v3.16.1mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-77USCWE-77USCWE-78US

affected products (34)

Products and version ranges known to be affected.

Versa Director 21.2.2all versionscisa_csaf_itUS
Versa Director 21.2.3 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.1all versionscisa_csaf_itUS
Versa Director 22.1.2 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.3 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.4 February 8, 2025all versionsfixedcisa_csaf_itUS
Versa Director >=21.2.3|<21.2.3 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.2|<22.1.2 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.3|<22.1.3 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.4|<22.1.4 February 8, 2025all versionscisa_csaf_itUS
Versa Directorall versionsfixedcisa_csaf_itUS
Versa Directorall versionscisa_csaf_itUS
Versa Director21.2.3| → 21.2.3 June 10, 2025cisa_csaf_itUS
Versa Director22.1.2| → 22.1.2 June 10, 2025cisa_csaf_itUS
Versa Director22.1.3| → 22.1.3 June 10, 2025cisa_csaf_itUS
Versa Director22.1.4| → 22.1.4 February 8, 2025cisa_csaf_itUS
Versa Director≤ 22.1.2 ≤22.1.2enisa_euvdEU
Versa Director≤ 22.1.1 ≤22.1.1enisa_euvdEU
Versa Director≤ 21.2.3 ≤21.2.3enisa_euvdEU
Versa Director≤ 22.1.4 ≤22.1.4enisa_euvdEU

showing 20 of 34

advisories (1)

Vendor and ecosystem advisories describing this.

VA-25-169-01Versa Networks Versa Director multiple vulnerabilities2025-07-02csaf · cisa_csaf_itUS
Versa Networks Versa Director contains a variety of vulnerabilities. In the most severe cases, a remote, unauthenticated attacker could execute arbitrary code with administrative privileges.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_it NVD CVE.org MITRE

published 2025-06-19modified 2026-09-03

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan