PT-2025-26197 · Versa · Versa Director Sd-Wan Orchestration Platform

Published 2025-06-18 · Updated 2025-06-19 · CVE-2025-24291

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Versa Director SD-WAN orchestration platform (affected versions not specified)

Description The issue concerns the Java code handling file uploads in the Versa Director SD-WAN orchestration platform, which contains an argument injection vulnerability. This allows an attacker to bypass MIME type validation by appending additional arguments to the file name, enabling the upload of arbitrary file types. As a result, a malicious file can be placed on disk. There are no reported instances of this vulnerability being exploited, but a proof of concept has been disclosed by third-party security researchers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Argument Injection

Weakness Enumeration

CWE-74

CWE-88

Related Identifiers

BDU:2025-09792

CVE-2025-24291

Affected Products

Versa Director Sd-Wan Orchestration Platform

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-24291 · Security Note
• https://bdu.fstec.ru/vul/2025-09792 · Security Note
• https://vuldb.com/?id.313261 · Note
• https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2 · Note
• https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3 · Note
• https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3 · Note
• https://security-portal.versa-networks.com/emailbulletins/68526fc6dc94d6b9f2faf71d · Note
• https://twitter.com/CVEnew/status/1935723270961287217 · Twitter Post
• https://t.me/cvetracker/26544 · Telegram Post
• https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4 · Note