EUVD-2025-18672Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.5 (Network, Low Complexity, No Privileges Required, High Integrity Impact) indicates high exploitability with real-world severity. The AV:N/AC:L/PR:N/UI:N characteristics confirm this is network-exploitable without authentication or user interaction, representing worst-case attack surface conditions. However, several mitigating factors temper actual exploitation probability: (1) No KEV status reported and no known active exploitation despite POC availability suggests exploitation barrier exists or disclosure was recent, (2) Remediation is straightforward (port restriction or upgrades), reducing dwell time, (3) CVSS notes 'C:N' (no confidentiality impact), limiting data exfiltration scope. The CWE-200 classification (information exposure) combined with High Integrity Impact suggests attackers can modify uCPE configurations or network policies rather than extract sensitive data. For organizations running Versa Director with internet-facing port 6080, this moves from theoretical to critical operational risk. SSVC analysis: Exploitation is now possible (POC exists), likely automatable (network service), with high technical impact (orchestration platform compromise). This warrants immediate action for exposed instances despite moderate exploitation probability. |
| Exploit ScenarioDerived | An attacker performs internet-wide reconnaissance, identifying Versa Director instances with port 6080 exposed using network scanning. Upon discovering an exposed websockify service, attacker attempts connection and exploits known websockify protocol vulnerabilities (e.g., improper input validation, authentication bypass, or VNC protocol weaknesses) without authentication. Successful exploitation grants remote console access to uCPE virtual machines, enabling attacker to: (1) modify SD-WAN routing policies affecting customer traffic, (2) pivot to underlying hypervisor or management network, (3) deploy persistent backdoors in network appliances. Given AC:L and PR:N, exploitation requires no specialized skills beyond running publicly available POC code. Attack succeeds in minutes against unpatched, unmitigated instances. Real-world impact: compromised Director controlling hundreds of customer edge devices across enterprise WAN could lead to widespread traffic interception, BGP hijacking, or DDoS amplification. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Network-accessible remote code execution vulnerability in Versa Director SD-WAN orchestration platform where the websockify service on port 6080 is exposed by default to the internet, allowing unauthenticated attackers to exploit known websockify weaknesses for potential code execution. Versa Networks confirms no active exploitation has been observed, but third-party proof-of-concept has been publicly disclosed. The vulnerability affects Versa Director deployments with default configurations and represents a critical supply-chain risk for SD-WAN infrastructure.
RemediationAI
Immediate mitigation: Restrict TCP port 6080 access via network firewall/WAF rules to authorized management networks only; disable internet routing to this port if uCPE console access is not required. Disable websockify service if console access unnecessary. Long-term remediation: Upgrade Versa Director to patched version (specific version numbers should be referenced from Versa Networks security advisory—not provided in CVE description; contact vendor for timeline). Implement network segmentation isolating Director management interfaces from untrusted networks. Enable VPN/zero-trust access controls for Director management. Monitor port 6080 access logs for suspicious connection attempts. Conduct inventory of exposed Director instances using network scanning tools (Shodan, Censys queries for 'websockify' or port 6080 banners).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Versa Director provides web-based console access to uCPE (universal Customer Premises Equipment) virtual machines through websockify, a WebSocket-to-VNC proxy service. Websockify (typically running on TCP port 6080) bridges WebSocket connections to underlying VNC protocols, enabling remote console management through modern browsers. The vulnerability exploits CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), where the websockify service lacks proper authentication or network isolation by default. Websockify has documented security weaknesses in its protocol implementation and authentication mechanisms that, combined with internet accessibility, create an unauthenticated attack surface. The SD-WAN orchestration platform's role managing network infrastructure amplifies the impact—compromised Director instances could lead to lateral movement across customer premises equipment and network topology manipulation.
Know when Versa Director gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
DescriptionCVE.org
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Restrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions.
Executive ViewAI
Versa Director SD-WAN orchestration platforms are exposed to a high-severity remote code execution vulnerability through an internet-facing console service (port 6080) that is enabled by default. Organizations using Versa Director for critical network infrastructure are at risk of unauthorized system access and potential network compromise, particularly if console access is not operationally required.
Restrict TCP port 6080 access at network perimeter (firewall rules, WAF, network segmentation); disable websockify service if uCPE console functionality is not operationally required; implement IP whitelisting to limit access to port 6080 from known administrative jump hosts only; monitor port 6080 for unauthorized access attempts and suspicious traffic patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Versa Director
View allThe Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. Rated critical severity (CVSS
A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. Rated medium severity (CVSS 6.1), this vulnerabi
Critical authentication bypass vulnerability in Versa Director that exposes multiple services (SSH, PostgreSQL, and othe
CVE-2025-23172 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in Versa Director SD-WAN orchestrati
CVE-2025-23171 is an insecure file upload vulnerability in Versa Director SD-WAN orchestration platform that allows auth
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the
The Versa Director offers REST APIs for orchestration and management. Rated medium severity (CVSS 6.6), this vulnerabili
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OT
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, foote
The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the J
GitHub PoC
Exploit-DB