PT-2025-26195 · Versa · Versa Director

Published

2025-06-18

·

Updated

2025-06-23

·

CVE-2025-23173

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions Versa Director SD-WAN orchestration platform (affected versions not specified)
Description The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet, introducing significant risk due to known weaknesses in websockify that can be exploited, potentially leading to remote code execution. There are no reported instances of this vulnerability being exploited, but a proof of concept has been disclosed by third-party security researchers.
Recommendations Restrict access to TCP port 6080 if uCPE console access is not necessary. Upgrade the Director to one of the remediated software versions.

Fix

RCE

Improper Access Control

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2025-09168
CVE-2025-23173

Affected Products

Versa Director