CVE-2024-42450
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Versa Director by default uses a common password across all PostgreSQL instances and configures the database to listen on all network interfaces. This allows an unauthenticated attacker to access and administer the database or read local filesystem contents, potentially leading to privilege escalation.
Risk Assessment
The risk to the organization includes unauthorized access to sensitive operational and configuration data, potential privilege escalation on the system, and data integrity compromise. The attack can be performed remotely without authentication, increasing its severity.
Recommendation
It is recommended to immediately upgrade Versa Director to version 22.1.4 or later, which automatically restricts access to PostgreSQL and HA ports. For older releases, perform manual hardening of HA ports as described in the Versa Networks documentation.
Other vulnerabilities in Versa Director
See all- CVE-2025-24288Critical
Versa Director exposes several services by default, including SSH and PostgreSQL, and uses default credentials for multiple accounts (most with sudo access). This allows attackers to easily gain access. Versa Networks is not aware of exploitation, but a proof of concept has been disclosed.
- CVE-2024-39717HighActively exploited
In the Versa Director GUI, the 'Change Favicon' option allows a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to upload a malicious file with a .png extension masquerading as an image. This requires prior authentication.
- CVE-2019-25029Critical
In Versa Director, a command injection vulnerability was detected that allows execution of arbitrary commands on the host operating system via a vulnerable application. The attack is possible when the application passes unsafe user-supplied data to a system shell, largely due to insufficient input validation.
- CVE-2025-24291Medium
The Versa Director SD-WAN orchestration platform contains an argument injection vulnerability in the Java code handling file uploads. An attacker can bypass MIME type validation and upload arbitrary file types, allowing placement of a malicious file on disk.
- CVE-2025-23170Medium
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept has been disclosed by third party security researchers.
- CVE-2025-23169Medium
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. Versa Networks is not aware of any exploitation, but a proof of concept has been disclosed.
- CVE-2024-45229Medium
Versa Director offers REST APIs for orchestration and management. Some APIs, such as login screen, banner display, and device registration, do not require authentication. It was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing authentication tokens of other logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose usernames or passwords.
Original NVD description (English source)
The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By default, Versa Director configures Postgres to listen on all network interfaces. This combination allows an unauthenticated attacker to access and administer the database or read local filesystem contents to escalate privileges on the system. Exploitation Status: Versa Networks is not aware of this exploitation in any production systems. A proof of concept exists in the lab environment. Workarounds or Mitigation: Starting with the latest 22.1.4 version of Versa Director, the software will automatically restrict access to the Postgres and HA ports to only the local and peer Versa Directors. For older releases, Versa recommends performing manual hardening of HA ports. Please refer to the following link for the steps https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Secure_HA_Ports This vulnerability is not exploitable on Versa Directors if published Firewall guidelines are implemented. We have validated that no Versa-hosted head ends have been affected by this vulnerability. All Versa-hosted head ends are patched and hardened. Please contact Versa Technical Support or Versa account team for any further assistance. Software Download Links: 22.1.4: https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4
Vulnerability data from NVD (NIST) · CISA KEV · EPSS