Versa Director EUVD-2025-18671

The CVSS 3.1 score of 7.2 (High) reflects significant risk with High confidentiality, integrity, and availability impact (C:H/I:H/A:H), though it requires high-privilege authentication (PR:H). The CVSS vector AV:N/AC:L indicates network-accessible vulnerability with low attack complexity. However, the PR:H (High Privileges Required) constraint substantially limits the practical attack surface—only authenticated administrators or account-compromised high-privilege users can exploit this. The absence of KEV (Known Exploited Vulnerabilities) listing and no reported active exploitation in the wild suggest current low real-world exploitation probability, though POC availability increases risk trajectory. Using SSVC framework: exploitation is Proof-of-Concept (not yet widespread), the attack surface is limited to authenticated insiders, but technical impact is high (RCE/privilege escalation). This represents a moderate-to-high priority for organizations running Versa Director in environments where account compromise or insider threats are concerns, but not an immediate critical threat for well-segmented networks with strong access controls. Organizations should prioritize patching but can implement compensating controls (network segmentation, API endpoint whitelisting) as interim measures.

An attacker compromises or impersonates a high-privilege administrator account within an organization running Versa Director (e.g., through credential theft, phishing, or insider threat). The attacker logs into the Versa Director web console and navigates to the Webhook configuration interface. The attacker creates a new webhook with a malicious localhost target URL such as 'http://localhost:8080/api/execute?cmd=id' or targets a local management service running on the versa-privileged process. When the attacker clicks 'Test Webhook' or triggers the webhook notification, the Versa Director backend—executing as the 'versa' user with sudo privileges—sends an HTTP request to the localhost endpoint. If the localhost service accepts the crafted request and executes the embedded command (or if the localhost service is a known vulnerable application), arbitrary code execution occurs in the context of the privileged versa user, allowing the attacker to escalate privileges, exfiltrate configuration data, or compromise the entire SD-WAN infrastructure. Public POC disclosure increases the likelihood that the specific localhost endpoint and payload structure are now known to adversaries, accelerating exploitation timelines once account compromise occurs.