---
id: "CVE-2026-107244"
page: "https://infrastack.ai/live/CVE-2026-107244"
kind: "vulnerability"
aliases: ["CVE-2026-107244"]
title: "Versa VOS: hardcoded keys let attackers bypass login via ZTP service"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "VOS", "fixed": [], "affected": ">= 21.1.1, <= 21.2.3 (per CVE list data; not confirmed on Versa advisory)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "network-appliance", "sd-wan", "versa-flexvnf", "versa-vos", "zero-touch-provisioning"]
not_affected_if: ["nodejs-ztp-service-disabled", "provisioning-complete", "service-disabled"]
published_at: "2026-11-10T01:17:12+00:00"
first_seen_at: "2026-11-10T01:26:36+00:00"
updated_at: "2026-11-10T01:37:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107244", "first_seen_at": "2026-11-10T01:26:36+00:00"}, {"source": "analyst", "url": "https://cve.imfht.com/detail/CVE-2026-107244", "first_seen_at": "2026-11-10T01:37:09+00:00", "cites": ["https://cve.imfht.com/detail/CVE-2026-107244", "https://app.opencve.io/cve/CVE-2026-107244"]}]
exploit_sources: []
---

# Versa VOS: hardcoded keys let attackers bypass login via ZTP service

Link for people: https://infrastack.ai/live/CVE-2026-107244 (this .md is for agents)

The Node.js provisioning service on Versa VOS appliances (formerly FlexVNF) has a /decryptTest endpoint that sits before authentication and uses hardcoded decryption keys shared by all appliances. An unauthenticated attacker on the network can forge a valid token and receive a fully authenticated session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VOS affected >= 21.1.1, <= 21.2.3 (per CVE list data; not confirmed on Versa advisory) fixed no fixed version listed

## How to check

- Check whether the Node.js web service used for URL-based Zero Touch Provisioning is running on each VOS appliance (Versa's hardening guide for Hubs, Branches and Controllers says to disable it after provisioning); appliances where it is disabled are not exploitable.
- Test whether /decryptTest answers from networks that can reach the appliance.
- Listed range is VOS 21.1.1 to 21.2.3 (CVE list data). No fixed release found; check Versa's security portal (security-portal.versa-networks.com).

## Timeline

- 2026-11-10T01:26:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107244
- 2026-11-10T01:37:09+00:00 analyst https://cve.imfht.com/detail/CVE-2026-107244 — CVE text (via OpenCVE and CVE List V5 mirror) read; Versa's own PSIRT advisory not found, so nothing marked verified. Affected VOS 21.1.1 to 21.2.3 per CVE list data; no fixed version in sources. No exploitation or PoC found.

## Documents

- [describes] CVE-2026-107244 (CVE List V5 data: VOS 21.1.1 ~ 21.2.3) https://cve.imfht.com/detail/CVE-2026-107244
- [mentions] CVE-2026-107244 - OpenCVE https://app.opencve.io/cve/CVE-2026-107244

## From the sources

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.  

Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_