Versa Director Flaws Let Attackers Execute Arbitrary Commands

A new set of high-severity vulnerabilities has been found in Versa Networks’ Versa Director SD-WAN platform, allowing attackers to upload malicious files and execute commands remotely. Though no active exploits have been reported, proof-of-concept code raises the risk of targeted attacks. #VersaNetworks #CISA #CVEs

Keypoints

Vulnerabilities CVE-2025-23171 and CVE-2025-23172 affect Versa Director versions prior to the patches released in February and June 2025.
The flaws enable authenticated users to upload webshells and trigger remote code execution through insufficient backend validation.
The webhook abuse vulnerability allows command execution with sudo privileges, leading to full control over affected devices.
Versa Networks recommends upgrading to patched versions as there are no effective workarounds for disabling the vulnerable features.
Security authorities, including CISA, advise organizations to apply patches promptly due to the availability of proof-of-concept exploits.