Versa-networks vulnerabilities
We track 8 vulnerabilities in Versa-networks products across 3 products. 8 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on December 20, 2025.
Latest Versa-networks vulnerabilities
- 7.8 High severity
SASE Client for Windows: Execution with Unnecessary Privileges
Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file sy
- 9.8 Critical severity
Director: Initialization of a Resource with an Insecure Default
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh
- 7.5 High severity
Director: Exposure of Sensitive Information to an Unauthorized Actor
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significa
- 7.2 High severity
Director: Server-Side Request Forgery
The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests
- 7.2 High severity
Director: Unrestricted Upload of File with Dangerous Type
The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Vers
- 8.8 High severity
Director: Authentication Bypass by Spoofing
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a vali
- 10.0 Critical severity
Director: Use of Hard-coded Credentials
The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Director. The default configuration has a common password across all instances of Versa Director. By defaul
- 7.2 High severity
Versa Director Dangerous File Type Upload Exploited
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege