{"id":"CVE-2026-107244","kind":"vulnerability","aliases":["CVE-2026-107244"],"related":[],"title":"Versa VOS: hardcoded keys let attackers bypass login via ZTP service","description":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.  \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.","summary":"The Node.js provisioning service on Versa VOS appliances (formerly FlexVNF) has a /decryptTest endpoint that sits before authentication and uses hardcoded decryption keys shared by all appliances. An unauthenticated attacker on the network can forge a valid token and receive a fully authenticated session.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VOS","fixed":[],"affected":">= 21.1.1, <= 21.2.3 (per CVE list data; not confirmed on Versa advisory)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","network-appliance","sd-wan","versa-flexvnf","versa-vos","zero-touch-provisioning"],"not_affected_if":["nodejs-ztp-service-disabled","provisioning-complete","service-disabled"],"how_to_check":"- Check whether the Node.js web service used for URL-based Zero Touch Provisioning is running on each VOS appliance (Versa's hardening guide for Hubs, Branches and Controllers says to disable it after provisioning); appliances where it is disabled are not exploitable.\n- Test whether /decryptTest answers from networks that can reach the appliance.\n- Listed range is VOS 21.1.1 to 21.2.3 (CVE list data). No fixed release found; check Versa's security portal (security-portal.versa-networks.com).","fix":null,"status":"open","published_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:28:21+00:00","updated_at":"2026-11-10T01:37:09+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T01:28:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Versa VOS: hardcoded keys let attackers bypass login via ZTP service","impact":"high","summary":"The Node.js provisioning service on Versa VOS appliances (formerly FlexVNF) has a /decryptTest endpoint that sits before authentication and uses hardcoded decryption keys shared by all appliances. An unauthenticated attacker on the network can forge a valid token and receive a fully authenticated session.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["versa-vos","versa-flexvnf","network-appliance"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gets an authenticated session on the appliance without credentials","analyst_note":"Affected and fixed versions are not in the sources; check the NVD entry and Versa's advisory for version ranges and a patch.","how_to_check":"- Check whether the Node.js web service used for URL-based Zero Touch Provisioning is still enabled on each VOS appliance\n- Confirm whether the /decryptTest endpoint is reachable from the network\n- Versions affected: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["service-disabled","provisioning-complete"],"who_is_affected":"Appliances running the VOS software with the Node.js ZTP web service enabled are exposed; the source states this service is not required after provisioning. Devices where the service has been disabled are not exploitable, per the vendor's hardening guide, which recommends disabling it after initial provisioning. Teams with VOS appliances reachable over the network should check this first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4768,"output_tokens":606,"severity_before":"high"},"analyst_status":"done","analyst_note":"Affected and fixed versions are not in the sources; check the NVD entry and Versa's advisory for version ranges and a patch.","search":"'-107244':14A,17A '-2026':13A,16A '/decrypttest':48B,112C,171C 'access':162C 'across':153C 'applianc':22B,43B,62B,102C,156C 'attack':6A,65B,159C 'authent':53B,78B,124C,129C,176C 'base':94C 'branch':189C 'bypass':7A 'complet':110C 'comput':164C 'control':191C 'creat':127C 'credenti':181C 'cve':12A,15A 'decrypt':57B,137C,148C 'devic':205C,213C 'disabl':193C,221C 'endpoint':49B,113C 'exploit':210C 'flexvnf':28B,45B,88C 'forg':70B 'former':44B 'fulli':77B,175C 'guid':186C 'hardcod':3A,56B,150C 'harden':185C 'hub':188C 'ident':152C 'infrastructur':19B 'initi':143C,200C 'iv':145C 'key':4A,58B,141C 'let':5A 'login':8A 'middlewar':125C 'network':21B,68B,161C 'network-appli':20B 'node.js':37B,81C,195C,216C 'obtain':173C 'previous':86C 'provid':179C 'provis':35B,38B,97C,108C,201C 'receiv':75B,133C 'recommend':192C 'regist':118C 'requir':106C 'sd':24B 'sd-wan':23B 'secur':184C 'server.js':120C 'servic':11A,39B,83C,116C,197C,218C 'session':79B,123C,130C,177C 'share':59B 'sit':51B 'submit':168C 'success':138C 'token':73B,135C,167C 'touch':34B,96C 'unauthent':64B,158C 'url':93C 'url-bas':92C 'use':55B,90C,146C 'valid':72B,166C 'vector':144C 'versa':1A,27B,30B,41B,87C,182C 'versa-flexvnf':26B 'versa-vo':29B 'via':9A 'vos':2A,18A,31B,42B,85C,101C,155C,204C,212C 'vulner':207C 'wan':25B 'web':82C,196C,217C 'whenev':131C 'without':178C 'zero':33B,95C 'zero-touch-provis':32B 'ztp':10A,98C","nicknames":[],"mitigations":[],"who_affected":"Versa VOS (formerly FlexVNF) appliances, such as SD-WAN hubs, branches and controllers, that still run the Node.js URL-based ZTP web service. An attacker with network access can forge a token with the shared hardcoded key and IV and get an authenticated session with no credentials. Appliances where the service was disabled after provisioning are not exploitable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["vos"],"ptokens":["vos"],"labels":["high","infrastructure","networkappliance","sdwan","versaflexvnf","versavos","zerotouchprovisioning"],"campaign_type":null,"search_a":"'-107244':14A,17A '-2026':13A,16A 'attack':6A 'bypass':7A 'cve':12A,15A 'hardcod':3A 'key':4A 'let':5A 'login':8A 'servic':11A 'versa':1A 'via':9A 'vos':2A,18A 'ztp':10A","search_b":"'/decrypttest':48B 'applianc':22B,43B,62B 'attack':65B 'authent':53B,78B 'decrypt':57B 'endpoint':49B 'flexvnf':28B,45B 'forg':70B 'former':44B 'fulli':77B 'hardcod':56B 'infrastructur':19B 'key':58B 'network':21B,68B 'network-appli':20B 'node.js':37B 'provis':35B,38B 'receiv':75B 'sd':24B 'sd-wan':23B 'servic':39B 'session':79B 'share':59B 'sit':51B 'token':73B 'touch':34B 'unauthent':64B 'use':55B 'valid':72B 'versa':27B,30B,41B 'versa-flexvnf':26B 'versa-vo':29B 'vos':31B,42B 'wan':25B 'zero':33B 'zero-touch-provis':32B","search_c":"'/decrypttest':112C,171C 'access':162C 'across':153C 'applianc':102C,156C 'attack':159C 'authent':124C,129C,176C 'base':94C 'branch':189C 'complet':110C 'comput':164C 'control':191C 'creat':127C 'credenti':181C 'decrypt':137C,148C 'devic':205C,213C 'disabl':193C,221C 'endpoint':113C 'exploit':210C 'flexvnf':88C 'fulli':175C 'guid':186C 'hardcod':150C 'harden':185C 'hub':188C 'ident':152C 'initi':143C,200C 'iv':145C 'key':141C 'middlewar':125C 'network':161C 'node.js':81C,195C,216C 'obtain':173C 'previous':86C 'provid':179C 'provis':97C,108C,201C 'receiv':133C 'recommend':192C 'regist':118C 'requir':106C 'secur':184C 'server.js':120C 'servic':83C,116C,197C,218C 'session':123C,130C,177C 'submit':168C 'success':138C 'token':135C,167C 'touch':96C 'unauthent':158C 'url':93C 'url-bas':92C 'use':90C,146C 'valid':166C 'vector':144C 'versa':87C,182C 'vos':85C,101C,155C,204C,212C 'vulner':207C 'web':82C,196C,217C 'whenev':131C 'without':178C 'zero':95C 'ztp':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107244","severity":null,"published_at":"2026-11-10T01:17:12+00:00","modified_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107244:2397","url":"https://cve.imfht.com/detail/CVE-2026-107244","severity":null,"published_at":"2026-11-10T01:37:09+00:00","modified_at":"2026-11-10T01:37:09+00:00","first_seen_at":"2026-11-10T01:37:09+00:00","fetched_at":"2026-11-10T01:37:09+00:00","note":"CVE text (via OpenCVE and CVE List V5 mirror) read; Versa's own PSIRT advisory not found, so nothing marked verified. Affected VOS 21.1.1 to 21.2.3 per CVE list data; no fixed version in sources. No exploitation or PoC found.","cites":["https://cve.imfht.com/detail/CVE-2026-107244","https://app.opencve.io/cve/CVE-2026-107244"]}],"documents":[{"id":112472,"url":"https://cve.imfht.com/detail/CVE-2026-107244","title":"CVE-2026-107244 (CVE List V5 data: VOS 21.1.1 ~ 21.2.3)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112473,"url":"https://app.opencve.io/cve/CVE-2026-107244","title":"CVE-2026-107244 - OpenCVE","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}