CVE-2025-24288VulnerabilityPublished 18 Jun 2025Updated 23 Jun 2025

CVE-2025-24288: Versa Director · Insecure Default

Affects Versa DirectorSource CVE Database V5

Not known to be exploited · CVSS 9.8 Critical.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Versa Director	Affected =21.2.2 =21.2.3 =22.1.1 =22.1.2 =22.1.3 =22.1.4	Fixed in–

AI-suggested

Beyond the recommended password management policies, European organizations should implement the following specific mitigations: 1) Immediately restrict internet exposure of Versa Director management interfaces by placing them behind VPNs or secure access gateways to limit access to trusted users only. 2) Implement network-level access controls such as firewall rules or zero-trust network segmentation to isolate Versa Director servers from general internet traffic. 3) Conduct a thorough audit of all user accounts on Versa Director to identify and disable or remove any default or unused accounts, especially those with sudo privileges. 4) Enable multi-factor authentication (MFA) for all administrative access to Versa Director, if supported, to add an additional layer of security beyond passwords. 5) Monitor network traffic and authentication logs continuously for anomalous access patterns or brute-force attempts, integrating alerts into Security Information and Event Management (SIEM) systems. 6) Prepare for rapid deployment of patches or updates once Versa Networks releases them, including testing in staging environments to ensure compatibility. 7) Educate network and security teams about this vulnerability and ensure incident response plans include scenarios involving network management platform compromise. These targeted actions will reduce the attack surface and improve detection and response capabilities.

Description

The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends the following security controls: 1) Change default passwords to complex passwords 2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character 3) Passwords must be changed at least every 90 days 4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password.5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.

Impact

For European organizations, the impact of CVE-2025-24288 could be substantial. Versa Director is often deployed in enterprises and service providers managing SD-WAN and network orchestration, which are critical for business continuity and secure communications. Exploitation could lead to unauthorized access to network management consoles, enabling attackers to alter network configurations, intercept or redirect traffic, and potentially disrupt services. This could compromise sensitive corporate data, violate data protection regulations such as GDPR, and cause operational downtime. The exposure of SSH and PostgreSQL services to the internet increases the attack surface, making it easier for threat actors to exploit the vulnerability remotely. Additionally, the presence of multiple accounts with shared default credentials and sudo privileges amplifies the risk of privilege escalation and lateral movement within the network. Given the critical nature of network infrastructure, successful exploitation could also impact supply chains and critical infrastructure sectors in Europe, leading to broader economic and security consequences.

Summary

CVE-2025-24288 is a critical vulnerability affecting multiple versions (21.2.2 through 22.1.4) of Versa Networks' Versa Director software. Versa Director is a network management and orchestration platform commonly used to manage SD-WAN deployments and other network infrastructure components. The vulnerability arises because the software exposes several services by default, including SSH and PostgreSQL, directly to the internet. More critically, the system ships with multiple user accounts that share the same default credentials, many of which have sudo (administrative) privileges. This configuration allows an attacker to gain an initial foothold without needing to bypass complex authentication mechanisms. The vulnerability requires no user interaction and can be exploited remotely over the network with no privileges required, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The impact is severe, affecting confidentiality, integrity, and availability, as an attacker gaining access could fully control the system, manipulate network configurations, exfiltrate sensitive data, or disrupt network operations. Although no known exploits have been reported in the wild, proof-of-concept code has been publicly disclosed by third-party researchers, increasing the risk of exploitation. Versa Networks recommends several mitigation steps, including changing all default passwords to complex ones (minimum 8 characters with uppercase, lowercase, digits, and special characters), enforcing password rotation every 90 days, maintaining password history to prevent reuse of the last five passwords, and auditing authentication logs to detect suspicious activity. However, the absence of patches or updates in the provided information suggests that organizations must rely heavily on these configuration and operational controls until official patches are released. Given the criticality and ease of exploitation, this vulnerability represents a significant risk to any organization using affected Versa Director versions, especially those exposing the management interfaces to the internet.

CWE-1188Initialization of a Resource with an Insecure Default (opens in a new tab)
Base weakness
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
OWASP Cheat Sheets
Forgot Password (opens in a new tab)
OWASP ASVS 4.0.3
V2.3.1 (opens in a new tab)
V2.6.2 (opens in a new tab)
V2.7.6 (opens in a new tab)
Attack patterns
Exploitation of Thunderbolt Protection Flaws (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Jun 2025, 00:01 UTC

WeaknessesCWE-1188

Technical details

References

Community reviews

Related threats