CVE-2019-25029

CriticalCVSS 9.8

Published: 26/05/2021(UTC)Updated: 31/08/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.71%

85th percentile - higher than 85% of all known CVEs

Summary

In Versa Director, a command injection vulnerability was detected that allows execution of arbitrary commands on the host operating system via a vulnerable application. The attack is possible when the application passes unsafe user-supplied data to a system shell, largely due to insufficient input validation.

Risk Assessment

An attacker can execute commands with the privileges of the application, potentially leading to full system compromise, data theft, or service disruption.

Recommendation

Update Versa Director to the latest patched version. Additionally, implement input validation and apply the principle of least privilege.

Other vulnerabilities in Versa Director

CVE-2024-45229Medium
Versa Director offers REST APIs for orchestration and management. Some APIs, such as login screen, banner display, and device registration, do not require authentication. It was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing authentication tokens of other logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose usernames or passwords.

Original NVD description (English source)

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.