EUVD-2025-18672CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution.
Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
Workarounds or Mitigation:
Restrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions.
AnalysisAI
Network-accessible remote code execution vulnerability in Versa Director SD-WAN orchestration platform where the websockify service on port 6080 is exposed by default to the internet, allowing unauthenticated attackers to exploit known websockify weaknesses for potential code execution. Versa Networks confirms no active exploitation has been observed, but third-party proof-of-concept has been publicly disclosed. The vulnerability affects Versa Director deployments with default configurations and represents a critical supply-chain risk for SD-WAN infrastructure.
Technical ContextAI
Versa Director provides web-based console access to uCPE (universal Customer Premises Equipment) virtual machines through websockify, a WebSocket-to-VNC proxy service. Websockify (typically running on TCP port 6080) bridges WebSocket connections to underlying VNC protocols, enabling remote console management through modern browsers. The vulnerability exploits CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), where the websockify service lacks proper authentication or network isolation by default. Websockify has documented security weaknesses in its protocol implementation and authentication mechanisms that, combined with internet accessibility, create an unauthenticated attack surface. The SD-WAN orchestration platform's role managing network infrastructure amplifies the impact—compromised Director instances could lead to lateral movement across customer premises equipment and network topology manipulation.
RemediationAI
Immediate mitigation: Restrict TCP port 6080 access via network firewall/WAF rules to authorized management networks only; disable internet routing to this port if uCPE console access is not required. Disable websockify service if console access unnecessary. Long-term remediation: Upgrade Versa Director to patched version (specific version numbers should be referenced from Versa Networks security advisory—not provided in CVE description; contact vendor for timeline). Implement network segmentation isolating Director management interfaces from untrusted networks. Enable VPN/zero-trust access controls for Director management. Monitor port 6080 access logs for suspicious connection attempts. Conduct inventory of exposed Director instances using network scanning tools (Shodan, Censys queries for 'websockify' or port 6080 banners).
Share
External POC / Exploit Code
Leaving vuln.today