CVE-2024-39717

Versa Director CVE-2024-39717: Unrestricted file upload via the Change Favicon feature is exposed to administrators (Provider-Data-Center-Admin/System-Admin) after authentication, allowing a .png file to masquerade as an image and potentially lead to remote code execution. Versa issued a security...

CVE-2024-45229

Versa Director exposes certain REST APIs (login, banner, device registration) without authentication. A GET request with invalid arguments can be exploited by Directors connected to the Internet to obtain authentication tokens of other logged-in users, which can be used to call additional APIs on...

CVE-2019-25030

CVE-2019-25030 affects Versa Director, Versa Analytics and VOS. Passwords were stored without an adaptive hash or KDF, using Merkle-Damgard-based algorithms (e.g., MD5/SHA-1), enabling rainbow-table based cracking. The connected documents indicate the mitigation is to hash with adaptive algorithm...

CVE-2021-39285

Versa Director 16.1R2 Build S8 contains a cross-site scripting (XSS) vulnerability. An attacker can use the administration web interface URL to inject scripts. The CVE-2021-39285 entry documents this XSS issue; no explicit exploit details, affected component is Versa Director’s web interface, and...

CVE-2019-25029

Versa Director is affected by a command injection vulnerability. The attack relies on unsafe user-supplied data being passed to a system shell, allowing execution of arbitrary commands with the privileges of the vulnerable application. Root cause: insufficient input validation. Impact is describe...

CVE-2018-16496

CVE-2018-16496 affects Versa Director. The issue arises from an unauthenticated request that allows an attacker to change log levels, indicating an authorization/configuration flaw. NVD metrics (CVSSv2/v3) show a Medium severity with network vector, low complexity and no authentication required; ...

CVE-2018-16498

CVE-2018-16498 affects Versa Director where unencrypted backup files stored on the Versa deployment include credentials inside configuration files for components such as SNMP and SSL/Trust keystores. The root cause is plaintext credentials in backups, enabling potential exposure if backups are ac...

CVE-2025-23168

The CVE-2025-23168 entry describes a vulnerability in Versa Director SD-WAN’s 2FA via OTP over email/SMS. The authenticated attacker can abuse untrusted input when dispatching OTPs to redirect delivery to their device, enabling interception of codes. OTP/TOTP codes are not invalidated after use, ...

CVE-2025-23171

CVE-2025-23171 affects Versa Director SD-WAN orchestration platform. The vulnerability arises from improper restriction of file upload permissions, where the UI may not reflect upload capability, yet uploads succeed and the system discloses full filenames of temporary files (including UUID prefix...