Threats tagged 'ghsa-9w28-8j9j-hwrh'

The Node.js web service on Versa Operating System (VOS), formerly Versa FlexVNF, supports URL-based Zero Touch Provisioning (ZTP) and uses default credentials with HTTP Basic Authentication during initial provisioning. This service is not required after provisioning completes. An attacker with network access and knowledge of the default credentials could authenticate and perform provisioning actions on the device. Disabling this service after provisioning mitigates the vulnerability.