PT-2025-26193 · Versa · Versa Director Sd-Wan Orchestration Platform

Published 2025-06-18 · Updated 2025-07-26 · CVE-2025-23171

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Versa Director SD-WAN orchestration platform (affected versions not specified)

Description The Versa Director SD-WAN orchestration platform has an issue with file upload permissions, allowing authenticated attackers to upload arbitrary files, including webshells, despite the UI not appearing to allow file uploads. Additionally, the platform discloses the full filename of uploaded temporary files. There are no reported instances of this issue being exploited, but a proof of concept has been disclosed by third-party security researchers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Unrestricted File Upload

Weakness Enumeration

CWE-377

CWE-266

CWE-434

Related Identifiers

BDU:2025-09777

CVE-2025-23171

Affected Products

Versa Director Sd-Wan Orchestration Platform

References · 15

• https://bdu.fstec.ru/vul/2025-09777 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23171 · Security Note
• https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2 · Note
• https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3 · Note
• https://twitter.com/Komodosec/status/1948926130154836293 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1935511625202532768 · Twitter Post
• https://t.me/cvetracker/26538 · Telegram Post
• https://vuldb.com/?id.313259 · Note
• https://security-portal.versa-networks.com/emailbulletins/68526dbbdc94d6b9f2faf71a · Note
• https://twitter.com/CVEnew/status/1935723272819380554 · Twitter Post
• https://t.me/latest_high_impact_cve/2714 · Telegram Post
• https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3 · Note
• https://t.me/cvenotify/126403 · Telegram Post
• https://twitter.com/fridaysecurity/status/1935529670809907648 · Twitter Post
• https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4 · Note