CVE-2025-23172

highpriority · track · 0EPSS 0.011 · 66 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.11% (66th) EPSS

CVSS 7.2 · high

Is it mine?

34 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_it

EPSS · scored 2026-10-27

The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedDirectorcisa_csaf_it
Fixed in 21.2.3 June 10, 2025, and later.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715
No fix availableDirectorcisa_csaf_it
No fix information provided for 21.2.2.
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715

cvss

Technical severity, 0–10. One row per scoring source.

7.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.17.2highAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · support@hackerone.comexploitability 1.2 · impact 5.9

v3.16.6mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1286USCWE-1286USCWE-284USCWE-285USCWE-918USCWE-918US

affected products (34)

Products and version ranges known to be affected.

Versa Director 21.2.2all versionscisa_csaf_itUS
Versa Director 21.2.3 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.1all versionscisa_csaf_itUS
Versa Director 22.1.2 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.3 June 10, 2025all versionsfixedcisa_csaf_itUS
Versa Director 22.1.4 February 8, 2025all versionsfixedcisa_csaf_itUS
Versa Director >=21.2.3|<21.2.3 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.2|<22.1.2 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.3|<22.1.3 June 10, 2025all versionscisa_csaf_itUS
Versa Director >=22.1.4|<22.1.4 February 8, 2025all versionscisa_csaf_itUS
Versa Directorall versionsfixedcisa_csaf_itUS
Versa Directorall versionscisa_csaf_itUS
Versa Director21.2.3| → 21.2.3 June 10, 2025cisa_csaf_itUS
Versa Director22.1.2| → 22.1.2 June 10, 2025cisa_csaf_itUS
Versa Director22.1.3| → 22.1.3 June 10, 2025cisa_csaf_itUS
Versa Director22.1.4| → 22.1.4 February 8, 2025cisa_csaf_itUS
Versa Director≤ 22.1.2 ≤22.1.2enisa_euvdEU
Versa Director≤ 21.2.3 ≤21.2.3enisa_euvdEU
Versa Director≤ 22.1.1 ≤22.1.1enisa_euvdEU
Versa Director≤ 22.1.3 ≤22.1.3enisa_euvdEU

showing 20 of 34

advisories (1)

Vendor and ecosystem advisories describing this.

VA-25-169-01Versa Networks Versa Director multiple vulnerabilities2025-07-02csaf · cisa_csaf_itUS
Versa Networks Versa Director contains a variety of vulnerabilities. In the most severe cases, a remote, unauthenticated attacker could execute arbitrary code with administrative privileges.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_it NVD CVE.org MITRE

published 2025-06-19modified 2026-09-03

references (17)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan