Dashboard / CVE-2026-107241

CVE-2026-107241

HIGH
MEDIUM Priority: 0.02 BB Relevance: 40/100
Published: 2026-11-10 Modified: 2026-11-12 First seen: 2026-11-10 Status: active

Attack Surface

Network Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: Required
S: Changed
C: High
I: High
A: High

Description

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

Weakness Classification (1)

Affected Software (10)

VendorProductVersion
Versa VOS 21.1.1
Versa VOS 22.1.2 < July 2, 2026
Versa VOS 22.1.3 < July 2, 2026
Versa VOS 22.1.4 < July 2, 2026
Versa VOS 23.1.2 < Aug 3, 2026
Versa VOS 21.1.1
Versa VOS 22.1.2 < July 2, 2026
Versa VOS 22.1.3 < July 2, 2026
Versa VOS 22.1.4 < July 2, 2026
Versa VOS 23.1.2 < Aug 3, 2026

References & Advisories (1)

Bug Bounty Relevance

40 / 100
✓ Network accessible

CVSS Score

7.6 / 10.0 v3.0
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

0.29%
Raw Score 0.002930
Percentile 22.1%
Date 2026-11-10

Intelligence Sources

mitre ref →
nvd ref →

External Links