PT-2025-26189 · Versa+1 · Versa Director+1

Published

2025-06-18

·

Updated

2025-06-23

·

CVE-2024-45208

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Versa Director SD-WAN orchestration platform (affected versions not specified)
Description The issue affects the Versa Director SD-WAN orchestration platform, which utilizes the Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. An attacker with access to the Versa Director could exploit this to perform unauthorized administrative actions and achieve remote code execution on the NCS service via port 4566. Versa Networks is not aware of any reported instances where this issue was exploited, but a proof of concept has been disclosed by third-party security researchers.
Recommendations Follow the hardening guide to secure the Versa Director SD-WAN orchestration platform. As a temporary workaround, consider restricting access to TCP ports 4566 and 4570 to minimize the risk of exploitation. Avoid using the shared password for High Availability (HA) information exchange until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Access Control

Using Hardcoded Credentials

Weakness Enumeration

CWE-284CWE-798

Related Identifiers

BDU:2025-10124
CVE-2024-45208

Affected Products

Cisco Ncs
Versa Director