CVE-2026-107240 · Infrastructure
NO FIX YET
The Node.js provisioning service on Versa VOS (formerly FlexVNF) passes login fields to a shell without stripping newlines, so a newline in the username runs extra commands. An unauthenticated attacker who fetches a CSRF token from a page load can execute arbitrary commands as the versa OS service user.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
VOS (formerly Versa FlexVNF) appliances where the Node.js URL-based Zero Touch Provisioning web service is still running. An attacker who can reach it needs no login, only a CSRF token from a page load, to run shell commands as the versa OS service user. Devices where the service was disabled after provisioning, as Versa's hardening guide recommends, are not exploitable.
Not affected if provisioning-complete, service-disabled
Who cares network-appliance, sd-wan, versa-flexvnf, versa-vos
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.