{"id":"CVE-2026-107243","kind":"vulnerability","aliases":["CVE-2026-107243"],"related":[],"title":"Versa VOS: hardcoded session secret lets attackers forge login cookies","description":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.","summary":"The Node.js provisioning web service on Versa VOS (formerly FlexVNF) signs session cookies with a hardcoded secret shared by every VOS appliance. An attacker who obtains a valid session ID can forge a cookie that any VOS appliance in the deployment accepts.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","sd-wan","self-hosted","versa-flexvnf","versa-vos"],"not_affected_if":["provisioning-complete","service-disabled"],"how_to_check":"- Check whether the Node.js web service used for URL-based zero touch provisioning is still enabled on each VOS appliance; per the CVE text, devices where it is disabled are not exploitable.\n- Affected and fixed VOS versions are not published in any source I could reach (Versa's PSIRT advisory on the Versa Security Portal was not retrievable): unknown. Check the Versa Security Portal for CVE-2026-107243.","fix":null,"status":"open","published_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:28:22+00:00","updated_at":"2026-11-10T01:36:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T01:28:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Versa VOS: hardcoded session secret lets attackers forge login cookies","impact":"high","summary":"The Node.js provisioning web service on Versa VOS (formerly FlexVNF) signs session cookies with a hardcoded secret shared by every VOS appliance. An attacker who obtains a valid session ID can forge a cookie that any VOS appliance in the deployment accepts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["versa-vos","versa-flexvnf","sd-wan","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker forges session cookies accepted by every VOS appliance","analyst_note":"Confirm affected VOS versions and the fixed release from the Versa advisory; the sources list no product ranges.","how_to_check":"- Check whether the Node.js web service used for zero touch provisioning is still enabled on each VOS appliance\n- Confirm the VOS version against the product ranges in the Versa advisory, which the sources do not list: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["service-disabled","provisioning-complete"],"who_is_affected":"VOS appliances that still run the Node.js web service used for URL-based zero touch provisioning are exposed. Per the description, disabling that service after initial provisioning, as Versa's hardening guide recommends, removes the exposure. Appliances where the service is disabled are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00076,"input_tokens":4765,"output_tokens":568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected VOS versions and the fixed release from the Versa advisory; the sources list no product ranges.","search":"'-107243':13A,16A '-2026':12A,15A 'accept':71B,157C,173C 'across':119C,165C 'applianc':51B,67B,94C,122C,168C,177C 'attack':7A,53B,131C 'base':86C 'branch':188C 'complet':102C 'comput':142C 'configur':111C 'control':190C 'cooki':10A,42B,63B,129C,153C,171C 'correct':144C 'cve':11A,14A 'deploy':70B,180C 'devic':204C,212C 'disabl':192C,220C 'everi':49B 'exploit':209C 'express':105C 'express-sess':104C 'flexvnf':26B,39B,80C 'forg':8A,61B,150C,170C 'former':38B 'guid':185C 'hardcod':3A,45B,114C 'harden':184C 'hmac':146C 'hmac-sha256':145C 'host':23B 'hub':187C 'id':59B,137C 'ident':118C 'infrastructur':17B 'initi':199C 'legitim':159C 'let':6A 'login':9A 'middlewar':107C 'node.js':31B,73C,194C,215C 'obtain':55B,133C 'previous':78C 'provis':32B,89C,100C,200C 'recommend':191C 'requir':98C 'sd':19B 'sd-wan':18B 'secret':5A,46B,115C,162C 'secur':183C 'self':22B 'self-host':21B 'server':156C 'server.js':109C 'servic':34B,75C,196C,217C 'session':4A,41B,58B,106C,128C,136C,152C 'sha256':147C 'share':47B,164C 'sign':40B,127C 'signatur':148C 'sourc':140C 'touch':88C 'url':85C 'url-bas':84C 'use':82C,125C 'valid':57B,135C 'versa':1A,25B,28B,36B,79C,181C 'versa-flexvnf':24B 'versa-vo':27B 'vos':2A,29B,37B,50B,66B,77C,93C,121C,167C,176C,203C,211C 'vulner':206C 'wan':20B 'web':33B,74C,195C,216C 'zero':87C 'ztp':90C","nicknames":[],"mitigations":[],"who_affected":"VOS appliances that still run the Node.js web service used for URL-based zero touch provisioning are exposed. Per the description, disabling that service after initial provisioning, as Versa's hardening guide recommends, removes the exposure. Appliances where the service is disabled are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","sdwan","selfhosted","versaflexvnf","versavos"],"campaign_type":null,"search_a":"'-107243':13A,16A '-2026':12A,15A 'attack':7A 'cooki':10A 'cve':11A,14A 'forg':8A 'hardcod':3A 'let':6A 'login':9A 'secret':5A 'session':4A 'versa':1A 'vos':2A","search_b":"'accept':71B 'applianc':51B,67B 'attack':53B 'cooki':42B,63B 'deploy':70B 'everi':49B 'flexvnf':26B,39B 'forg':61B 'former':38B 'hardcod':45B 'host':23B 'id':59B 'infrastructur':17B 'node.js':31B 'obtain':55B 'provis':32B 'sd':19B 'sd-wan':18B 'secret':46B 'self':22B 'self-host':21B 'servic':34B 'session':41B,58B 'share':47B 'sign':40B 'valid':57B 'versa':25B,28B,36B 'versa-flexvnf':24B 'versa-vo':27B 'vos':29B,37B,50B,66B 'wan':20B 'web':33B","search_c":"'accept':157C,173C 'across':119C,165C 'applianc':94C,122C,168C,177C 'attack':131C 'base':86C 'branch':188C 'complet':102C 'comput':142C 'configur':111C 'control':190C 'cooki':129C,153C,171C 'correct':144C 'deploy':180C 'devic':204C,212C 'disabl':192C,220C 'exploit':209C 'express':105C 'express-sess':104C 'flexvnf':80C 'forg':150C,170C 'guid':185C 'hardcod':114C 'harden':184C 'hmac':146C 'hmac-sha256':145C 'hub':187C 'id':137C 'ident':118C 'initi':199C 'legitim':159C 'middlewar':107C 'node.js':73C,194C,215C 'obtain':133C 'previous':78C 'provis':89C,100C,200C 'recommend':191C 'requir':98C 'secret':115C,162C 'secur':183C 'server':156C 'server.js':109C 'servic':75C,196C,217C 'session':106C,128C,136C,152C 'sha256':147C 'share':164C 'sign':127C 'signatur':148C 'sourc':140C 'touch':88C 'url':85C 'url-bas':84C 'use':82C,125C 'valid':135C 'versa':79C,181C 'vos':77C,93C,121C,167C,176C,203C,211C 'vulner':206C 'web':74C,195C,216C 'zero':87C 'ztp':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107243","severity":null,"published_at":"2026-11-10T01:17:12+00:00","modified_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107243:2398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107243","severity":null,"published_at":"2026-11-10T01:36:58+00:00","modified_at":"2026-11-10T01:36:58+00:00","first_seen_at":"2026-11-10T01:36:58+00:00","fetched_at":"2026-11-10T01:36:58+00:00","note":"Versa PSIRT advisory not reachable (portal returned no content); only the NVD/CNA text found. No versions or fix known, no exploitation reported, no PoC. Nothing verified. Sibling CVEs 107240/107242/107244 are the same Node.js ZTP service. X not searched.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-107243"]}],"documents":[{"id":112471,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107243","title":"NVD: CVE-2026-107243","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}