CVE-2025-23170

Versa Director exposes several services by default, including SSH and PostgreSQL, and uses default credentials for multiple accounts (most with sudo access). This allows attackers to easily gain access. Versa Networks is not aware of exploitation, but a proof of concept has been disclosed.

Versa Director by default uses a common password across all PostgreSQL instances and configures the database to listen on all network interfaces. This allows an unauthenticated attacker to access and administer the database or read local filesystem contents, potentially leading to privilege escalation.

In Versa Director, a command injection vulnerability was detected that allows execution of arbitrary commands on the host operating system via a vulnerable application. The attack is possible when the application passes unsafe user-supplied data to a system shell, largely due to insufficient input validation.

The Versa Director SD-WAN orchestration platform contains an argument injection vulnerability in the Java code handling file uploads. An attacker can bypass MIME type validation and upload arbitrary file types, allowing placement of a malicious file on disk.

The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. Versa Networks is not aware of any exploitation, but a proof of concept has been disclosed.

Versa Director offers REST APIs for orchestration and management. Some APIs, such as login screen, banner display, and device registration, do not require authentication. It was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing authentication tokens of other logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose usernames or passwords.