Threats tagged 'ghsa-6q48-p66m-9xm5'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	7.6	CVE-2026-107244The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the High7.62026-11-10GCVE DatabaseCVE-2026-107244 A vulnerability in the Node.js web service on VOS (formerly Versa FlexVNF) allows unauthenticated attackers with network access to gain a fully authenticated session. This occurs because the /decryptTest endpoint accepts a token that decrypts successfully using a hardcoded key and IV shared across all VOS appliances. The service is intended for Zero Touch Provisioning (ZTP) and should be disabled after provisioning. Devices with the Node.js web service disabled are not vulnerable. Report on CVE-2026-107244 Vulnerability CWE-1390 #ghsa-6q48-p66m-9xm5	GCVE Database	2026-11-10

Page 1 of 1