Read the docs

Versa

Records25All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

Versa records in CISA KEV
TI-2025-24195 Versa Concerto Improper Authentication Vulnerability Priority CRITICAL 97KEV 2026-01-22TI-2024-26638 Versa Director Dangerous File Type Upload Vulnerability Priority CRITICAL 91KEV 2024-08-23

Components

Products in the NVD configurations · select one to filter the records
Versa Director 16 records CRITICAL Versa Operating System 4 records MEDIUM Concerto 3 records CRITICAL Versa Analytics 2 records LOW Sase Client 1 record LOW

Records

16 records in Versa Director · all components

TI-2024-26638 CVE-2024-39717 · GHSA-7v24-gjqv-fwg7

Unrestricted file upload in Versa Director

Priority CRITICAL 91KEV

The Versa Director GUI provides an option to customize the look and feel of the user interface.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03987 Published 2024-08-22 Fixed in 21.2.3 before 2024-06-21 CWE-434
TI-2024-28419 CVE-2024-42450 · GHSA-hfwx-j6h2-rmf7

Hard-coded credentials in Versa Director

Priority MEDIUM 50

The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00589 Published 2024-11-19 No fix listed CWE-798
TI-2025-18035 CVE-2025-24288 · GHSA-rwr4-qw9c-fjxm

The Versa Director software exposes a number of services by default and allow attackers…

Priority MEDIUM 49

The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00474 Published 2025-06-18 No fix listed CWE-1188
TI-2019-15169 CVE-2019-25029 · GHSA-288v-wgqw-xcfp

Command injection in Versa Director

Priority MEDIUM 47

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02403 Published 2021-05-26 No fix listed CWE-77
TI-2025-16958 CVE-2025-23173 · GHSA-r448-hfqj-rxrc

Information disclosure in Versa Director

Priority MEDIUM 40

The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00617 Published 2025-06-18 No fix listed CWE-200
TI-2025-16953 CVE-2025-23168 · GHSA-p4f9-mqjc-2hrf

Authentication bypass by spoofing in Versa Director

Priority LOW 38

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00395 Published 2025-06-18 No fix listed CWE-290
TI-2025-16957 CVE-2025-23172 · GHSA-683j-3v25-h2qg

Server-side request forgery in Versa Director

Priority LOW 36

The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01119 Published 2025-06-18 No fix listed CWE-918
TI-2025-16956 CVE-2025-23171 · GHSA-jjg2-f6h2-x2p6

Unrestricted file upload in Versa Director

Priority LOW 34

The Versa Director SD-WAN orchestration platform provides an option to upload various types of files.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00555 Published 2025-06-18 No fix listed CWE-434
TI-2025-16955 CVE-2025-23170 · GHSA-6hw8-whvq-hmwp

Command injection in Versa Director

Priority LOW 33

The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00595 Published 2025-06-18 No fix listed CWE-77
TI-2024-30306 CVE-2024-45229 · GHSA-q2pv-h46f-8gvc

Missing authentication in Versa Director

Priority LOW 32

The Versa Director offers REST APIs for orchestration and management.

CVSS 3.0MEDIUM 6.6 Network High privileges No interaction EPSS 0.00514 Published 2024-09-20 Fixed in 22.1.4 20240909, 22.1.3 20240909 +4 CWE-306
TI-2025-18038 CVE-2025-24291 · GHSA-w5m4-587r-x2v2

Injection in Versa Director

Priority LOW 29

The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00381 Published 2025-06-18 No fix listed CWE-74
TI-2025-16954 CVE-2025-23169 · GHSA-grg9-576x-5279

Cross-site scripting in Versa Director

Priority LOW 29

The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00385 Published 2025-06-18 No fix listed CWE-79
TI-2018-11839 CVE-2018-16498 · GHSA-pc3c-mp2m-rr8w

Cleartext storage of sensitive information in Versa Director

Priority LOW 24

In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00166 Published 2021-05-26 No fix listed CWE-312
Open these records in search →