Vulnerabilities

Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating the requesting user. Due to improper privilege handling and a time-of-check time-of-use race condition combined with symbolic link and mount point manipulation, a local authenticated attacker can coerce the service into deleting arbitrary directories with SYSTEM privileges. This can be exploited to delete protected system folders such as C:\\Config.msi and subsequently achieve execution as NT AUTHORITY\\SYSTEM via MSI rollback techniques.

The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends the following security controls: 1) Change default passwords to complex passwords 2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character 3) Passwords must be changed at least every 90 days 4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password. 5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.

Versa Concerto, Versa Networks' SD-WAN orchestration platform, mishandles authentication in its Traefik reverse proxy configuration, allowing unauthenticated attackers to reach administrative endpoints. By chaining this bypass with the Spack upload endpoint, an attacker can trigger a time-of-check to time-of-use (TOCTOU) file write combined with a race condition to manipulate path loading and achieve remote code execution without any credentials. Successful exploitation gives the attacker code execution on the Concerto server, with related coverage warning the flaws could let attackers escape the Docker container and compromise the underlying host (CVSS 4.0 score 10.0, critical). Concerto versions 12.1.2 through 12.2.0 are known to be affected, and additional versions may also be vulnerable, so any internet-exposed or broadly reachable Concerto deployment is at risk. A public proof-of-concept walkthrough has been published, the flaw sits in the 99th EPSS percentile with a 45.2% probability of exploitation within 30 days, and it is not yet on CISA's KEV list.

Do: Upgrade Concerto to a release beyond 12.2.0 as directed by Versa's advisory, since additional versions may also be affected. Until patched, restrict access to Concerto's portal/administrative endpoints and the Spack upload endpoint to trusted management networks only, and review access logs for unauthenticated requests to administrative endpoints. Because exploitation involves a timing-based race, network-level access restriction is the most reliable interim mitigation.

Versa Concerto, Versa Networks' SD-WAN orchestration and management platform, contains an authentication-bypass flaw (CWE-288) in its Traefik reverse proxy configuration that allows unauthenticated remote attackers to reach administrative endpoints that should require login. The flaw is network-reachable with no privileges or user interaction required, and the internal Actuator endpoint is also reachable, letting attackers pull heap dumps and trace logs that may contain sensitive information. Public research (Project Discovery) demonstrates the bypass can be chained toward remote code execution, and separate Versa Concerto flaws reported publicly have been shown to allow Docker escapes and compromise of the underlying host. Known-affected versions are Concerto 12.1.2 through 12.2.0, with additional versions possibly vulnerable, so any organization running a vulnerable Concerto instance — particularly one exposed to the internet — is at risk. The flaw is confirmed to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22, and EPSS assigns an ~82% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Concerto to the fixed release per Versa Networks' security advisory — the known-affected range is 12.1.2 through 12.2.0, but because additional versions may be vulnerable, confirm the patched version with the vendor; U.S. federal agencies must apply these mitigations or discontinue use of the product under BOD 22-01. In the meantime, restrict internet exposure of Concerto portals and its administrative/Actuator endpoints, and review trace logs and any evidence of heap-dump access for signs of unauthenticated administrative requests.

The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres to listen on all network interfaces. This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system. Exploitation Status: Versa Networks is not aware of this exploitation in any production systems. A proof of concept exists in the lab environment. Workarounds or Mitigation: Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors. For older releases, Versa recommends performing manual hardening of HA ports. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports This vulnerability is not exploitable on Versa Directors if published Firewall guidelines are implemented. We have validated that no Versa-hosted head ends have been affected by this vulnerability. All Versa-hosted head ends are patched and hardened. Please contact Versa Technical Support or Versa account team for any further assistance. Software Download Links: 22.1.4: https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4

The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/* (on ports 9182 & 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.

CVE-2024-39717 is an unrestricted file upload flaw (CWE-434) in the interface customization function of Versa Networks' Versa Director: the 'Change Favicon' option in the GUI accepts an uploaded file that merely ends in a .png extension, so a malicious file can masquerade as an image. Exploitation requires network access to the Director GUI and valid credentials for a Provider-Data-Center-Admin or Provider-Data-Center-System-Admin account (tenant-level users cannot reach the feature), which is why the 7.2 CVSS score includes 'high privileges required.' By planting a dangerous file disguised as a .png, an attacker gains a code-execution path on the Director server consistent with the flaw's high confidentiality, integrity and availability impact ratings. Any organization running Versa Director — particularly service providers and internet providers whose management interface is reachable from the internet — is potentially affected. Exploitation is confirmed in the wild: China-linked actor Volt Typhoon used the flaw as a zero-day against U.S. and global IT targets, CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-23, and federal agencies were urged to patch by September 2024.

Do: Apply Versa Networks' fix/mitigation instructions — CISA's required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable — and meet the September 2024 federal remediation deadline if applicable. Restrict access to the Versa Director GUI to trusted management networks rather than exposing it to the internet, and audit and rotate credentials for Provider-Data-Center-Admin and Provider-Data-Center-System-Admin accounts, since the observed Volt Typhoon activity relied on valid high-privilege logins. Check Director systems for unexpected files uploaded through the Change Favicon feature that may be disguised as .png images.

A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. An attacker can use the administration web interface URL to create a XSS based attack.

In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user root, there is a potential privilege escalation vulnerability. In this case, the job runs a script as root that is writable by users who are members of the versa group.

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result in an arbitrary read, write, or execution of newly created files and directories. Insecure umask setting was present throughout the Versa servers.