TI-2024-26638 Aliases CVE-2024-39717 GHSA-7v24-gjqv-fwg7

Unrestricted file upload in Versa Director

CRITICAL 91Exploited in the wildCWE-434Published 2024-08-22 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

Why it matters now

Exploitation Active In CISA KEV since 2024-08-23CISA due date 2024-09-13

EPSS 0.03987 90th percentileScored 2026-11-07

Fix Fixed Director (Versa): 21.2.3 before 2024-06-21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Versa	Director	21.2.2 – 21.2.2; 21.2.3 before 2024-06-21 to before 21.2.3 before 2024-06-21; 22.1.1 – 22.1.1; 22.1.2 before 2024-06-21 – 22.1.2 before 2024-06-21; 22.1.3 before 2024-06-21 – 22.1.3 before 2024-06-21	21.2.3 before 2024-06-21	Patch available	CNA

Director VendorVersa Affected 21.2.2 – 21.2.2; 21.2.3 before 2024-06-21 to before 21.2.3 before 2024-06-21; 22.1.1 – 22.1.1; 22.1.2 before 2024-06-21 – 22.1.2 before 2024-06-21; 22.1.3 before 2024-06-21 – 22.1.3 before 2024-06-21 Fixed in 21.2.3 before 2024-06-21 Patch available CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:versa-networks:versa_director:21.2.2:::::::*	21.2.2	Vulnerable	Versa
cpe:2.3:a:versa-networks:versa_director:21.2.3:::::::*	21.2.3	Vulnerable	Versa
cpe:2.3:a:versa-networks:versa_director:22.1.1:::::::*	22.1.1	Vulnerable	Versa
cpe:2.3:a:versa-networks:versa_director:22.1.2:::::::*	22.1.2	Vulnerable	Versa
cpe:2.3:a:versa-networks:versa_director:22.1.3:::::::*	22.1.3	Vulnerable	Versa

cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:* Versions 21.2.2 Vulnerable ·Versa
cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:* Versions 21.2.3 Vulnerable ·Versa
cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:* Versions 22.1.1 Vulnerable ·Versa
cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:* Versions 22.1.2 Vulnerable ·Versa
cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Versa

Remediation

Fix · CNA Director (Versa) Fixed in 21.2.3 before 2024-06-21

Timeline

2024-08-23 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2024-39717
2026-10-03 Alias added: GHSA-7v24-gjqv-fwg7

References

Advisory 1

https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/

TI-2024-28419 Hard-coded credentials in Versa Director CVSS 3.1CRITICAL 10.0
TI-2025-18035 The Versa Director software exposes a number of services by default and allow attackers… CVSS 3.1CRITICAL 9.8
TI-2019-15169 Command injection in Versa Director CVSS 3.1CRITICAL 9.8
TI-2025-16958 Information disclosure in Versa Director CVSS 3.1HIGH 7.5
TI-2025-16953 Authentication bypass by spoofing in Versa Director CVSS 3.1HIGH 8.8
TI-2025-16957 Server-side request forgery in Versa Director CVSS 3.1HIGH 7.2

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences