CVE-2026-107241 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Node.js zero-touch provisioning web service on Versa VOS appliances (formerly FlexVNF) authenticates with default credentials over HTTP Basic Authentication. An attacker on the network who knows those defaults can log in and perform provisioning actions on the appliance.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running Versa VOS appliances (previously Versa FlexVNF) that still have the Node.js zero-touch provisioning web service enabled after initial setup. The service is not needed after provisioning finishes, so appliances where it has been disabled are not exploitable. Attackers need network access to the service and the default credentials.
Not affected if provisioning-complete, service-disabled
Who cares flexvnf, network-appliance, versa-vos
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.