VOS · CVE-2026-107244 · Infrastructure
NO FIX YET
The Node.js provisioning service on Versa VOS appliances (formerly FlexVNF) has a /decryptTest endpoint that sits before authentication and uses hardcoded decryption keys shared by all appliances. An unauthenticated attacker on the network can forge a valid token and receive a fully authenticated session.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Versa VOS (formerly FlexVNF) appliances, such as SD-WAN hubs, branches and controllers, that still run the Node.js URL-based ZTP web service. An attacker with network access can forge a token with the shared hardcoded key and IV and get an authenticated session with no credentials. Appliances where the service was disabled after provisioning are not exploitable.
Not affected if nodejs-ztp-service-disabled, provisioning-complete, service-disabled
Who cares network-appliance, sd-wan, versa-flexvnf, versa-vos, zero-touch-provisioning
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.