VOS vulnerabilities

6 known vulnerabilities in VOS from Versa. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  VOS: Stack-based Buffer Overflow

  CVE-2026-107245Nov 10, 2026Versa

  Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Den

• 7.6 High severity

  VOS: Weak Authentication

  CVE-2026-107244Nov 10, 2026Versa

  The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before t

• 7.6 High severity

  VOS: Use of Hard-coded Credentials

  CVE-2026-107243Nov 10, 2026Versa

  The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded se

• 9.1 Critical severity

  VOS: Generation of Predictable Numbers or Identifiers

  CVE-2026-107242Nov 10, 2026Versa

  The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), whi

• 7.6 High severity

  VOS: Weak Authentication

  CVE-2026-107241Nov 10, 2026Versa

  The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface duri

• 7.6 High severity

  VOS: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-107240Nov 10, 2026Versa

  The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and