{"id":"CVE-2026-107241","kind":"vulnerability","aliases":["CVE-2026-107241"],"related":[],"title":"Versa VOS: provisioning web service uses default credentials, allowing network access","description":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.","summary":"The Node.js zero-touch provisioning web service on Versa VOS appliances (formerly FlexVNF) authenticates with default credentials over HTTP Basic Authentication. An attacker on the network who knows those defaults can log in and perform provisioning actions on the appliance.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flexvnf","infrastructure","network-appliance","versa-vos"],"not_affected_if":["provisioning-complete","service-disabled"],"how_to_check":"- Confirm whether the Node.js web service for URL-based zero-touch provisioning is enabled on each VOS appliance\n- Check whether the default credentials still work on the provisioning interface","fix":"Per the sources, Versa's hardening guide recommends disabling the Node.js web service after initial provisioning; the vulnerability is not exploitable where it is disabled. No fixed version is stated in the sources.","status":"open","published_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:35+00:00","triaged_at":"2026-11-10T01:28:23+00:00","updated_at":"2026-11-10T01:28:23+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T01:28:23Z","model":"claude-haiku-5-5","output":{"fix":"Per the sources, Versa's hardening guide recommends disabling the Node.js web service after initial provisioning; the vulnerability is not exploitable where it is disabled. No fixed version is stated in the sources.","reach":"network","title":"Versa VOS: provisioning web service uses default credentials, allowing network access","impact":"high","summary":"The Node.js zero-touch provisioning web service on Versa VOS appliances (formerly FlexVNF) authenticates with default credentials over HTTP Basic Authentication. An attacker on the network who knows those defaults can log in and perform provisioning actions on the appliance.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["versa-vos","flexvnf","network-appliance"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker performs provisioning actions on the appliance using default credentials","analyst_note":"Check Versa's security advisory for the affected VOS version ranges and the exact fixed release; the NVD entry alone does not state them.","how_to_check":"- Confirm whether the Node.js web service for URL-based zero-touch provisioning is enabled on each VOS appliance\n- Check whether the default credentials still work on the provisioning interface\n- unknown for the exact command or setting path in the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["service-disabled","provisioning-complete"],"who_is_affected":"Organizations running Versa VOS appliances (previously Versa FlexVNF) that still have the Node.js zero-touch provisioning web service enabled after initial setup. The service is not needed after provisioning finishes, so appliances where it has been disabled are not exploitable. Attackers need network access to the service and the default credentials.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4705,"output_tokens":665,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107241':14A,17A '-2026':13A,16A 'access':11A,122C 'action':63B,136C 'administr':103C 'allow':9A 'applianc':22B,37B,66B,89C,140C 'attack':49B,119C 'authent':40B,47B,100C,117C,129C 'base':81C 'basic':46B,116C 'branch':148C 'complet':97C 'control':150C 'could':128C 'credenti':8A,43B,113C,127C 'cve':12A,15A 'default':7A,42B,56B,112C,126C 'devic':164C,172C 'disabl':152C,180C 'exploit':169C 'flexvnf':18B,39B,75C 'former':38B 'guid':145C 'harden':144C 'http':45B,115C 'hub':147C 'infrastructur':19B 'initi':109C,159C 'interfac':107C 'know':54B,124C 'log':58B 'network':10A,21B,52B,121C 'network-appli':20B 'node.js':27B,68C,154C,175C 'perform':61B,134C 'previous':73C 'provis':3A,31B,62B,84C,95C,110C,135C,160C 'recommend':151C 'requir':93C 'secur':143C 'servic':5A,33B,70C,99C,132C,156C,177C 'touch':30B,83C 'url':80C 'url-bas':79C 'use':6A,77C,111C 'user':101C 'versa':1A,24B,35B,74C,141C 'versa-vo':23B 'vos':2A,25B,36B,72C,88C,139C,163C,171C 'vulner':166C 'web':4A,32B,69C,106C,155C,176C 'zero':29B,82C 'zero-touch':28B 'ztp':85C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Versa VOS appliances (previously Versa FlexVNF) that still have the Node.js zero-touch provisioning web service enabled after initial setup. The service is not needed after provisioning finishes, so appliances where it has been disabled are not exploitable. Attackers need network access to the service and the default credentials.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["flexvnf","high","infrastructure","networkappliance","versavos"],"campaign_type":null,"search_a":"'-107241':14A,17A '-2026':13A,16A 'access':11A 'allow':9A 'credenti':8A 'cve':12A,15A 'default':7A 'network':10A 'provis':3A 'servic':5A 'use':6A 'versa':1A 'vos':2A 'web':4A","search_b":"'action':63B 'applianc':22B,37B,66B 'attack':49B 'authent':40B,47B 'basic':46B 'credenti':43B 'default':42B,56B 'flexvnf':18B,39B 'former':38B 'http':45B 'infrastructur':19B 'know':54B 'log':58B 'network':21B,52B 'network-appli':20B 'node.js':27B 'perform':61B 'provis':31B,62B 'servic':33B 'touch':30B 'versa':24B,35B 'versa-vo':23B 'vos':25B,36B 'web':32B 'zero':29B 'zero-touch':28B","search_c":"'access':122C 'action':136C 'administr':103C 'applianc':89C,140C 'attack':119C 'authent':100C,117C,129C 'base':81C 'basic':116C 'branch':148C 'complet':97C 'control':150C 'could':128C 'credenti':113C,127C 'default':112C,126C 'devic':164C,172C 'disabl':152C,180C 'exploit':169C 'flexvnf':75C 'guid':145C 'harden':144C 'http':115C 'hub':147C 'initi':109C,159C 'interfac':107C 'know':124C 'network':121C 'node.js':68C,154C,175C 'perform':134C 'previous':73C 'provis':84C,95C,110C,135C,160C 'recommend':151C 'requir':93C 'secur':143C 'servic':70C,99C,132C,156C,177C 'touch':83C 'url':80C 'url-bas':79C 'use':77C,111C 'user':101C 'versa':74C,141C 'vos':72C,88C,139C,163C,171C 'vulner':166C 'web':69C,106C,155C,176C 'zero':82C 'ztp':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107241","severity":null,"published_at":"2026-11-10T01:17:12+00:00","modified_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:35+00:00","fetched_at":"2026-11-10T01:26:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}