CVE-2026-107244

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...

CVE-2026-107244

The Node.js web service on VOS (formerly Versa FlexVNF) is vulnerable to an authentication bypass. The /decryptTest endpoint in server.js is registered before the session authentication middleware and creates an authenticated session upon successful token decryption. Because the decryption key an...

CVE-2026-107244: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…

The Node.js web service on VOS previously Versa FlexVNF is used for URL-based Zero Touch Provisioning ZTP of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and...