---
id: "CVE-2026-107241"
page: "https://infrastack.ai/live/CVE-2026-107241"
kind: "vulnerability"
aliases: ["CVE-2026-107241"]
title: "Versa VOS: provisioning web service uses default credentials, allowing network access"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["flexvnf", "infrastructure", "network-appliance", "versa-vos"]
not_affected_if: ["provisioning-complete", "service-disabled"]
published_at: "2026-11-10T01:17:12+00:00"
first_seen_at: "2026-11-10T01:26:35+00:00"
updated_at: "2026-11-10T01:28:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107241", "first_seen_at": "2026-11-10T01:26:35+00:00"}]
exploit_sources: []
---

# Versa VOS: provisioning web service uses default credentials, allowing network access

Link for people: https://infrastack.ai/live/CVE-2026-107241 (this .md is for agents)

The Node.js zero-touch provisioning web service on Versa VOS appliances (formerly FlexVNF) authenticates with default credentials over HTTP Basic Authentication. An attacker on the network who knows those defaults can log in and perform provisioning actions on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the Node.js web service for URL-based zero-touch provisioning is enabled on each VOS appliance
- Check whether the default credentials still work on the provisioning interface

## Fix

Per the sources, Versa's hardening guide recommends disabling the Node.js web service after initial provisioning; the vulnerability is not exploitable where it is disabled. No fixed version is stated in the sources.

## Timeline

- 2026-11-10T01:26:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107241

## From the sources

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  

Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_