Versa

Products

Exploited and recent CVEs

• CVE-2025-34026 Critical 9.2 Exploited Versa Concerto Actuator Authentication Bypass Information Leak 81.8%
• CVE-2024-39717 Medium 6.6 Exploited The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center- 4.0%
• CVE-2025-24288 Critical 9.8 The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same 0.5%
• CVE-2025-24291 Medium 6.1 The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By 0.4%
• CVE-2024-45208 Critical 9.8 The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability ( 0.9%
• CVE-2025-23171 High 7.2 The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow f 0.6%
• CVE-2025-23168 Medium 6.3 The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when 0.4%
• CVE-2025-23172 High 7.2 The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be a 1.1%
• CVE-2025-23173 High 7.5 The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and acce 0.6%
• CVE-2025-23169 Medium 6.1 The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properl 0.4%
• CVE-2025-23170 Medium 6.7 The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.p 0.6%
• CVE-2025-34025 High 8.6 Versa Concerto Insecure Docker Mount Container Escape 0.6%
• CVE-2025-34027 Critical 10.0 Versa Concerto Authentication Bypass File Write Remote Code Execution 46.4%
• CVE-2024-42450 Critical 10.0 The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a commo 0.6%
• CVE-2024-45229 Medium 6.6 The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However 0.5%