Versa Director CVE-2025-24288

This vulnerability presents exceptionally high real-world risk despite lacking confirmed active exploitation data. CVSS 9.8 accurately reflects severity: Network-accessible (AV:N), no attack complexity (AC:L), no privilege escalation required (PR:N), no user interaction (UI:N), and scope unchanged (S:U) yielding complete system compromise (C:H/I:H/A:H). The lack of complexity combined with immediate administrative access justifies the near-maximum score. The existence of public POC code significantly elevates SSVC exploitation likelihood to 'Proof of Concept' status. The fact that this is not yet KEV-listed does not diminish risk—it likely reflects recent disclosure rather than actual lack of exploitation. This is a genuine critical priority, not a high-CVSS-low-impact edge case, because: (1) Versa Director is deployed in critical network infrastructure roles (SD-WAN controllers), (2) default credential vulnerabilities are trivial to exploit at scale, (3) no patch availability is mentioned, requiring immediate workaround implementation. Organizations cannot wait for patched versions.

An attacker performs network reconnaissance and identifies a Versa Director instance exposed on the internet (likely through shodan/censys scanning or accidental public cloud deployment). The attacker attempts SSH access using publicly-known default credentials (e.g., admin/admin or similar). Access is granted immediately without rate-limiting or account lockout protections. The attacker gains a shell with sudo privileges. From this foothold, the attacker can: (1) pivot to internal network resources using the Versa Director's network control plane access, (2) exfiltrate sensitive network configuration and traffic policies, (3) modify routing or security policies to intercept traffic, (4) establish persistent backdoors, (5) access the embedded PostgreSQL database to extract user and configuration data. The attack requires no social engineering, no exploitation of code flaws, and no sophisticated techniques—it is a simple credential-based login that yields full system control. Given the POC is public, any attacker with basic scanning capabilities can execute this within minutes of identifying a vulnerable instance.