Read the docs
TI-2019-15169 Aliases CVE-2019-25029GHSA-288v-wgqw-xcfp

Command injection in Versa Director

Priority MEDIUM 47CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

Why it matters now

EPSS 0.02403 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Versa DirectorFixed Versions: 16.1R2S11, 20.2.2, 21.1.1, 21.2.1—No fix listedCNA
  • Versa Director Vendor— Affected Fixed Versions: 16.1R2S11, 20.2.2, 21.1.1, 21.2.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:*before 16.1R2S11; 20.2.0 to before 20.2.2; 21.1.0 to before 21.1.1; 21.2.0 to before 21.2.1VulnerableVersa
  • cpe:2.3:a:versa-networks:versa_director:*:*:*:*:*:*:*:* Versions before 16.1R2S11; 20.2.0 to before 20.2.2; 21.1.0 to before 21.1.1; 21.2.0 to before 21.2.1 Vulnerable ·Versa

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25029
  2. 2026-10-03 Alias added: GHSA-288v-wgqw-xcfp

References

Advisory 1

  • TI-2024-26638 Unrestricted file upload in Versa Director KEVCVSS 3.1HIGH 7.2
  • TI-2024-28419 Hard-coded credentials in Versa Director CVSS 3.1CRITICAL 10.0
  • TI-2025-18035 The Versa Director software exposes a number of services by default and allow attackers… CVSS 3.1CRITICAL 9.8
  • TI-2025-16958 Information disclosure in Versa Director CVSS 3.1HIGH 7.5
  • TI-2025-16953 Authentication bypass by spoofing in Versa Director CVSS 3.1HIGH 8.8
  • TI-2025-16957 Server-side request forgery in Versa Director CVSS 3.1HIGH 7.2
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences