Vulnerabilities

The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials.

The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files.

The Versa Director SD-WAN orchestration platform provides an option to upload various types of files.

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS.

The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints.

The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI.

The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo.

The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box.

The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data.

The Versa Director offers REST APIs for orchestration and management.

The Versa Director GUI provides an option to customize the look and feel of the user interface.

A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8.

In Versa Director, the un-authentication request found.

In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files.

In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage.

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application.