{"id":"CVE-2026-107240","kind":"vulnerability","aliases":["CVE-2026-107240"],"related":[],"title":"Versa VOS: unauthenticated newline injection runs shell commands on appliances","description":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.","summary":"The Node.js provisioning service on Versa VOS (formerly FlexVNF) passes login fields to a shell without stripping newlines, so a newline in the username runs extra commands. An unauthenticated attacker who fetches a CSRF token from a page load can execute arbitrary commands as the versa OS service user.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","network-appliance","sd-wan","versa-flexvnf","versa-vos"],"not_affected_if":["provisioning-complete","service-disabled"],"how_to_check":"- On each VOS device (branch, hub, controller), check whether the Node.js ZTP web service is still running; Versa says it is not needed after provisioning.\n- Check whether the management/provisioning web interface (the /authenticate endpoint) is reachable from networks an attacker can reach.\n- Per Versa, devices where the Node.js web service is disabled are not exploitable.\n- Affected VOS versions are not published in the sources I could read; ask Versa support/PSIRT for the advisory.","fix":null,"status":"open","published_at":"2026-11-10T01:17:10+00:00","first_seen_at":"2026-11-10T01:26:35+00:00","triaged_at":"2026-11-10T01:28:26+00:00","updated_at":"2026-11-10T01:39:27+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T01:28:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Versa VOS: unauthenticated newline injection runs shell commands on appliances","impact":"high","summary":"The Node.js provisioning service on Versa VOS (formerly FlexVNF) passes login fields to a shell without stripping newlines, so a newline in the username runs extra commands. An unauthenticated attacker who fetches a CSRF token from a page load can execute arbitrary commands as the versa OS service user.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["versa-vos","versa-flexvnf","sd-wan","network-appliance"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary shell commands execute on the appliance as the versa service user","analyst_note":"Find the vendor advisory and the fixed VOS versions; the sources give no product ranges or fix.","how_to_check":"- Check whether the Node.js web service used for URL-based Zero Touch Provisioning is still running on each VOS device\n- Look for the `/authenticate` endpoint being reachable on the appliance management interface\n- Confirm the service is disabled per Versa's hardening guide for Hubs, Branches, and Controllers","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["service-disabled","provisioning-complete"],"who_is_affected":"Only VOS appliances (formerly Versa FlexVNF) where the Node.js ZTP web service is still enabled are exposed; the sources say it is not required after initial provisioning. Teams that disabled it after provisioning are not exploitable, according to the description. Check any VOS device reachable on a network an attacker can reach.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4770,"output_tokens":640,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed VOS versions; the sources give no product ranges or fix.","search":"'-107240':13A,16A '-2026':12A,15A '/authenticate':111C 'applianc':10A,20B,101C 'arbitrari':71B,153C 'attack':59B,141C,167C 'base':93C 'branch':189C 'charact':138C,146C 'child_process.exec':125C 'command':8A,56B,72B,155C 'complet':109C 'control':191C 'credenti':163C 'csrf':63B,171C 'cve':11A,14A 'devic':205C,213C 'disabl':193C,221C 'endpoint':112C 'escaperegexp':129C 'execut':70B,152C 'exploit':210C 'express':133C 'extra':55B 'fetch':61B 'field':41B,150C 'flexvnf':26B,38B,87C 'former':37B 'guid':186C 'harden':185C 'hub':188C 'infrastructur':17B 'initi':200C 'inject':5A,143C 'load':68B,181C 'login':40B 'metacharact':134C 'need':168C 'network':19B 'network-appli':18B 'newlin':4A,47B,50B,137C,145C 'node.js':31B,80C,195C,216C 'obtain':176C 'os':76B,159C 'page':67B,180C 'pass':39B,116C 'password':122C 'previous':85C 'provis':32B,96C,107C,201C 'recommend':192C 'regular':132C 'remov':131C 'requir':105C,165C 'run':6A,54B 'sanit':128C 'sd':22B 'sd-wan':21B 'secur':184C 'servic':33B,77B,82C,115C,160C,197C,218C 'shell':7A,44B,154C 'strip':46B 'suppli':119C 'token':64B,172C 'touch':95C 'unauthent':3A,58B,140C,179C 'url':92C 'url-bas':91C 'use':89C 'user':78B,118C,161C 'user-suppli':117C 'usernam':53B,120C,149C 'valu':123C 'versa':1A,25B,28B,35B,75B,86C,158C,182C 'versa-flexvnf':24B 'versa-vo':27B 'vos':2A,29B,36B,84C,100C,204C,212C 'vulner':207C 'wan':23B 'web':81C,196C,217C 'without':45B 'zero':94C 'ztp':97C","nicknames":[],"mitigations":[],"who_affected":"VOS (formerly Versa FlexVNF) appliances where the Node.js URL-based Zero Touch Provisioning web service is still running. An attacker who can reach it needs no login, only a CSRF token from a page load, to run shell commands as the versa OS service user. Devices where the service was disabled after provisioning, as Versa's hardening guide recommends, are not exploitable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","networkappliance","sdwan","versaflexvnf","versavos"],"campaign_type":null,"search_a":"'-107240':13A,16A '-2026':12A,15A 'applianc':10A 'command':8A 'cve':11A,14A 'inject':5A 'newlin':4A 'run':6A 'shell':7A 'unauthent':3A 'versa':1A 'vos':2A","search_b":"'applianc':20B 'arbitrari':71B 'attack':59B 'command':56B,72B 'csrf':63B 'execut':70B 'extra':55B 'fetch':61B 'field':41B 'flexvnf':26B,38B 'former':37B 'infrastructur':17B 'load':68B 'login':40B 'network':19B 'network-appli':18B 'newlin':47B,50B 'node.js':31B 'os':76B 'page':67B 'pass':39B 'provis':32B 'run':54B 'sd':22B 'sd-wan':21B 'servic':33B,77B 'shell':44B 'strip':46B 'token':64B 'unauthent':58B 'user':78B 'usernam':53B 'versa':25B,28B,35B,75B 'versa-flexvnf':24B 'versa-vo':27B 'vos':29B,36B 'wan':23B 'without':45B","search_c":"'/authenticate':111C 'applianc':101C 'arbitrari':153C 'attack':141C,167C 'base':93C 'branch':189C 'charact':138C,146C 'child_process.exec':125C 'command':155C 'complet':109C 'control':191C 'credenti':163C 'csrf':171C 'devic':205C,213C 'disabl':193C,221C 'endpoint':112C 'escaperegexp':129C 'execut':152C 'exploit':210C 'express':133C 'field':150C 'flexvnf':87C 'guid':186C 'harden':185C 'hub':188C 'initi':200C 'inject':143C 'load':181C 'metacharact':134C 'need':168C 'newlin':137C,145C 'node.js':80C,195C,216C 'obtain':176C 'os':159C 'page':180C 'pass':116C 'password':122C 'previous':85C 'provis':96C,107C,201C 'recommend':192C 'regular':132C 'remov':131C 'requir':105C,165C 'sanit':128C 'secur':184C 'servic':82C,115C,160C,197C,218C 'shell':154C 'suppli':119C 'token':172C 'touch':95C 'unauthent':140C,179C 'url':92C 'url-bas':91C 'use':89C 'user':118C,161C 'user-suppli':117C 'usernam':120C,149C 'valu':123C 'versa':86C,158C,182C 'vos':84C,100C,204C,212C 'vulner':207C 'web':81C,196C,217C 'zero':94C 'ztp':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107240","severity":null,"published_at":"2026-11-10T01:17:10+00:00","modified_at":"2026-11-10T01:17:10+00:00","first_seen_at":"2026-11-10T01:26:35+00:00","fetched_at":"2026-11-10T01:26:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107240:2399","url":"https://docs.versa-networks.com/Management_and_Orchestration/Versa_Director/Configuration/Enable_Secure_Mode","severity":null,"published_at":"2026-11-10T01:39:27+00:00","modified_at":"2026-11-10T01:39:27+00:00","first_seen_at":"2026-11-10T01:39:27+00:00","fetched_at":"2026-11-10T01:39:27+00:00","note":"Versa's own PSIRT advisory not found/readable; only NVD (HackerOne CNA text) and Versa docs. No affected ranges or fixed versions published in anything I could read; OffSeq's AI-suggested range not used. Fix left unknown. Mitigation from Versa docs: 'request system secure-mode enable disable-nodejs' then vsh restart. Note CVSS vector says PR:H/UI:R while text says unauthenticated; flagged. Siblings CVE-2026-107242/-107243/-107244 are the same ZTP Node.js service.","cites":["https://docs.versa-networks.com/Management_and_Orchestration/Versa_Director/Configuration/Enable_Secure_Mode","https://nvd.nist.gov/vuln/detail/CVE-2026-107240"]}],"documents":[{"id":112484,"url":"https://docs.versa-networks.com/Management_and_Orchestration/Versa_Director/Configuration/Enable_Secure_Mode","title":"Versa docs: Enable Secure Mode (disable-nodejs option)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":112485,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107240","title":"NVD: CVE-2026-107240","kind":"advisory","source":"analyst","publisher":null,"text":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based ZTP and is not required after provisioning. The /authenticate endpoint passes username/password to child_process.exec() via escapeRegExp, which does not remove newlines. Unauthenticated attacker can inject a newline in username to run shell commands as the versa OS service user; needs a CSRF token from an unauthenticated page load. Versa hardening guide recommends disabling the Node.js web service after initial provisioning; not exploitable where disabled. CVSS 3.0 7.6 (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H), by HackerOne.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}