{"id":"CVE-2024-39717","kind":"vulnerability","aliases":["CVE-2024-39717"],"related":[],"title":"versa-networks versa director: The Versa Director GUI provides an option to customize the look and feel of the user interface","description":"The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.","summary":"Versa Director's GUI lets administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges upload a file through the Change Favicon feature, which only checks for a .png extension. An attacker with those admin roles can upload a malicious file disguised as a PNG, and CISA lists this flaw as actively exploited.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2024-08-23T00:00:00+00:00","products":[{"name":"Versa Director","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"versa-networks versa director","fixed":[],"affected":"= 21.2.2","ecosystem":"vendor"},{"name":"versa-networks versa director","fixed":[],"affected":"= 21.2.3","ecosystem":"vendor"},{"name":"versa-networks versa director","fixed":[],"affected":"= 22.1.1","ecosystem":"vendor"},{"name":"versa-networks versa director","fixed":[],"affected":"= 22.1.2","ecosystem":"vendor"},{"name":"versa-networks versa director","fixed":[],"affected":"= 22.1.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","service-providers","vendor","versa-director"],"not_affected_if":["no-provider-admin-users"],"how_to_check":null,"fix":"Apply the mitigation per Versa's vendor instructions, or discontinue use of the product if no mitigation is available (per CISA required action).","status":"open","published_at":"2024-08-22T19:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:19+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:58:19Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation per Versa's vendor instructions, or discontinue use of the product if no mitigation is available (per CISA required action).","reach":"unknown","impact":"high","summary":"Versa Director's GUI lets administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges upload a file through the Change Favicon feature, which only checks for a .png extension. An attacker with those admin roles can upload a malicious file disguised as a PNG, and CISA lists this flaw as actively exploited.","category":"vendor","who_cares":["versa-director","service-providers"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with admin role uploads malicious file to the server.","analyst_note":"Find Versa's advisory and the affected/fixed versions and the exact mitigation steps; sources here give no version data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-provider-admin-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000479,"input_tokens":2888,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':24A,27A '-39717':25A,28A 'activ':120B 'admin':75B,82B,103B,153C,160C,206C,213C 'administr':69B 'attack':100B 'authent':216C 'avail':143C 'center':74B,80B,152C,158C,205C,211C 'chang':89B,170C 'check':94B 'cisa':115B 'custom':14A,130C 'cve':23A,26A 'data':73B,79B,151C,157C,204C,210C 'director':5A,8A,30A,35A,40A,45A,50A,55A,63B,65B,124C 'disguis':110B 'end':185C 'exploit':56B,121B 'extens':98B,188C 'favicon':90B,171C 'favorit':172C 'featur':91B 'feel':18A,134C 'file':86B,109B,184C,193C 'flaw':118B 'gui':9A,67B,125C 'icon':173C 'imag':192C 'interfac':22A,138C 'let':68B 'level':162C 'list':116B 'log':147C,218C 'look':16A,132C 'malici':108B,183C 'masquerad':190C 'mis':178C 'mis-us':177C 'network':3A 'networks':33A,38A,43A,48A,53A 'option':12A,128C,140C,174C 'png':97B,113B,187C 'possibl':196C 'privileg':83B,168C 'provid':10A,59B,72B,78B,126C,150C,156C,203C,209C 'provider-data-center-admin':71B,149C,202C 'provider-data-center-system-admin':77B,155C,208C 'role':104B 'servic':58B 'service-provid':57B 'success':215C 'system':81B,159C,212C 'tenant':161C 'upload':84B,106B,181C 'use':179C 'user':21A,137C,146C,163C,200C 'vendor':60B 'versa':2A,4A,7A,29A,32A,34A,37A,39A,42A,44A,47A,49A,52A,54A,62B,64B,123C 'versa-director':61B 'versa-network':1A 'versa-networks':31A,36A,41A,46A,51A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-08-22T19:15:09+00:00","kev":{"dateAdded":"2024-08-23","dueDate":"2024-09-13","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-39717","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-39717","severity":null,"published_at":"2024-08-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:33+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-39717","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39717","severity":null,"published_at":"2024-08-22T19:15:09+00:00","modified_at":"2026-06-17T07:42:31+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}