PT-2025-26195 · Versa · Versa Director
Published
2025-06-18
·
Updated
2025-06-23
·
CVE-2025-23173
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Versa Director SD-WAN orchestration platform (affected versions not specified)
Description
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet, introducing significant risk due to known weaknesses in websockify that can be exploited, potentially leading to remote code execution. There are no reported instances of this vulnerability being exploited, but a proof of concept has been disclosed by third-party security researchers.
Recommendations
Restrict access to TCP port 6080 if uCPE console access is not necessary.
Upgrade the Director to one of the remediated software versions.
Fix
RCE
Improper Access Control
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Versa Director