{"id":"CVE-2026-107245","kind":"vulnerability","aliases":["CVE-2026-107245"],"related":[],"title":"Versa VOS: crafted IKE Auth packet crashes vsmd; Versa reports malicious IPsec traffic, fixed in builds from July 26 / Aug 3 2026","description":"Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. \n \n Buffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. \n \nDuring the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted?  \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet.","summary":"Versa's bulletin: a crafted IKE Auth packet with an oversized Remote ID overflows a stack buffer in VOS (FlexVNF) IPsec and crashes vsmd (denial of service). Versa rates it CRITICAL and says it is aware of malicious IPsec packets from 45.142.193.0/24, 102.135.43.0/24, 102.135.44.0/23, 102.135.46.0/24; it does not say whether any attack succeeded. No public PoC found. Workarounds (Versa): disable the staging VPN profile on Controllers/Hub Controllers when ZTP over Internet is not needed; set a remote peer IP/hostname/FQDN on site-to-site profiles; blackhole the known source IPs.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":null,"products":[{"name":"Versa VOS","fixed":["22.1.x build 2026-07-26 or later","23.1.x build 2026-08-03 or later"],"affected":"<= 23.1.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","flexvnf","internet-facing","ipsec","sd-wan","vendor","versa","vos"],"not_affected_if":["not-internet-reachable","overlay-endpoint","overlay-interface-endpoint"],"how_to_check":"Affected if a VOS node has an IPsec VPN profile of type controller-staging-sdwan or remote-access-server using a WAN interface as endpoint (typical for Controllers, Hub Controllers, SSE Gateways), or a site-to-site VPN profile with no peer IP/hostname/FQDN, AND the node is reachable from the Internet. Overlay-interface endpoints are not affected. Check your VOS build date: 22.1.x before July 26 2026 and 23.1.x before Aug 3 2026 are affected. Look for traffic from the source blocks above and vsmd crashes.","fix":"Install a VOS release dated July 26, 2026 or later (22.1.2, 22.1.3, 22.1.4) or August 3, 2026 or later (23.1.x); 21.2.3 is end-of-support, move to 22.1.4. Download links are in the Versa support portal.","status":"open","published_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:30:19+00:00","updated_at":"2026-11-10T01:43:17+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T01:30:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Versa VOS: crafted IKE packet crashes vsmd, causing denial of service","impact":"low","summary":"A malformed IKE Auth packet with an oversized Remote ID overflows a buffer in the IPsec implementation on Versa VOS and crashes the vsmd process. An attacker who can reach the WAN interface can take the appliance's VPN service down.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["versa","vos","flexvnf","ipsec","sd-wan"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker crashes the vsmd process, causing denial of service","analyst_note":"Find the Versa advisory and the fixed VOS/FlexVNF versions; the NVD entry gives none in the sources here.","how_to_check":"- Check whether any VOS node has an IPsec profile of type `controller-staging-sdwan` or `remote-access-server` using a WAN interface as the IPsec endpoint.\n- Check whether any site-to-site VPN profile has no peer IP address, hostname or FQDN configured.\n- Check whether the VOS WAN interfaces are reachable from the Internet.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-internet-reachable","overlay-endpoint"],"who_is_affected":"VOS nodes are exposed when an IPsec VPN profile of type controller-staging-sdwan or remote-access-server uses a WAN interface as its endpoint, which typically covers Controllers, Hub Controllers and SSE Gateways. Site-to-site VPN profiles without a peer IP address, hostname or FQDN are also vulnerable. Nodes that are not reachable from the Internet are not vulnerable, and profiles that use an overlay interface as endpoint are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000847,"input_tokens":4945,"output_tokens":704,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Versa advisory and the fixed VOS/FlexVNF versions; the NVD entry gives none in the sources here.","search":"'-107245':25A,28A '-2026':24A,27A '/23':92B '/24':88B,90B,94B '102.135.43.0':89B '102.135.44.0':91B '102.135.46.0':93B '2026':22A '26':19A '3':21A '45.142.193.0':87B 'access':276C,349C 'addit':314C 'address':326C 'affect':301C 'aka':153C 'also':331C 'appli':305C 'applianc':195C,256C 'attack':101B,183C,191C 'aug':20A 'auth':5A,52B,165C,201C 'authent':216C 'awar':81B 'blackhol':135B 'buffer':62B,144C,156C,235C 'build':16A 'bulletin':48B 'configur':262C,290C,303C,321C 'confirm':142C 'control':116B,270C,308C,310C 'controller-staging-sdwan':269C 'controllers/hub':115B 'craft':3A,50B,163C,197C 'crash':7A,68B,174C,248C 'creat':185C 'critic':76B 'cve':23A,26A 'denial':32B,70B,179C,188C 'denial-of-servic':31B,187C 'descript':159C 'disabl':109B 'endpoint':285C,298C 'face':38B 'fail':223C 'fix':14A 'flexvnf':35B,65B,155C 'found':106B 'fqdn':329C 'gateway':313C 'hostnam':327C 'hub':309C 'id':58B,230C,242C 'ike':4A,51B,164C,200C,215C,220C 'impact':259C,336C 'implement':150C 'interfac':209C,281C,294C 'internet':37B,120B,352C 'internet-fac':36B 'ip':139B,325C 'ip/hostname/fqdn':128B 'ipsec':12A,39B,66B,84B,149C,264C,284C,288C,297C 'juli':18A 'known':137B 'larger':232C 'list':340C 'malici':11A,83B,162C,199C 'need':123B 'negoti':222C 'node':261C,339C 'overflow':59B,145C,157C 'overlay':293C 'overs':56B 'packet':6A,53B,85B,166C,202C 'peer':127B,324C 'phase':217C 'poc':105B 'process':173C,239C,252C 'profil':113B,134B,266C,289C,320C 'public':104B 'rate':74B 'remot':57B,126B,229C,241C,275C 'remote-access-serv':274C 'report':10A 'result':176C,245C 'sa':221C 'say':78B,98B 'sd':41B 'sd-wan':40B 'sdwan':272C 'send':204C 'sent':168C 'server':277C 'servic':34B,72B,181C,190C 'set':124B 'site':131B,133B,316C,318C 'site-to-sit':130B,315C 'size':226C,236C 'sourc':138B 'sse':312C 'stack':61B 'stage':111B,271C 'succeed':102B 'therebi':175C 'traffic':13A 'type':268C 'typic':304C 'use':237C,278C 'vendor':43B 'versa':1A,9A,29A,44B,46B,73B,108B,140C,154C 'vos':2A,30A,45B,64B,152C,170C,194C,212C,255C,260C,338C 'vpn':112B,265C,319C 'vsmd':8A,69B,172C,251C 'vulner':146C,158C,287C,332C,344C 'wan':42B,208C,280C 'whether':99B 'without':322C 'workaround':107B 'ztp':118B","nicknames":[],"mitigations":[],"who_affected":"Versa VOS (FlexVNF) nodes that terminate IPsec on a WAN interface with a controller-staging-sdwan or remote-access-server profile, which typically means Controllers, Hub Controllers and SSE Gateways, plus site-to-site profiles with no remote peer set. Only nodes reachable from the Internet are exposed. Nodes not reachable from the Internet or using an overlay interface as endpoint can skip it.","tier":"A","verified":{"fix":{"at":"2026-11-10T01:37:43Z","by":"analyst","doc":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29","run_id":2396},"products":{"at":"2026-11-10T01:37:43Z","by":"analyst","doc":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29","run_id":2396},"how_to_check":{"at":"2026-11-10T01:37:43Z","by":"analyst","doc":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29","run_id":2396},"who_affected":{"at":"2026-11-10T01:37:43Z","by":"analyst","doc":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29","run_id":2396}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["versavos","vos"],"ptokens":["versa","vos"],"labels":["critical","denialofservice","flexvnf","internetfacing","ipsec","sdwan","vendor","versa","vos"],"campaign_type":null,"search_a":"'-107245':25A,28A '-2026':24A,27A '2026':22A '26':19A '3':21A 'aug':20A 'auth':5A 'build':16A 'craft':3A 'crash':7A 'cve':23A,26A 'fix':14A 'ike':4A 'ipsec':12A 'juli':18A 'malici':11A 'packet':6A 'report':10A 'traffic':13A 'versa':1A,9A,29A 'vos':2A,30A 'vsmd':8A","search_b":"'/23':92B '/24':88B,90B,94B '102.135.43.0':89B '102.135.44.0':91B '102.135.46.0':93B '45.142.193.0':87B 'attack':101B 'auth':52B 'awar':81B 'blackhol':135B 'buffer':62B 'bulletin':48B 'control':116B 'controllers/hub':115B 'craft':50B 'crash':68B 'critic':76B 'denial':32B,70B 'denial-of-servic':31B 'disabl':109B 'face':38B 'flexvnf':35B,65B 'found':106B 'id':58B 'ike':51B 'internet':37B,120B 'internet-fac':36B 'ip':139B 'ip/hostname/fqdn':128B 'ipsec':39B,66B,84B 'known':137B 'malici':83B 'need':123B 'overflow':59B 'overs':56B 'packet':53B,85B 'peer':127B 'poc':105B 'profil':113B,134B 'public':104B 'rate':74B 'remot':57B,126B 'say':78B,98B 'sd':41B 'sd-wan':40B 'servic':34B,72B 'set':124B 'site':131B,133B 'site-to-sit':130B 'sourc':138B 'stack':61B 'stage':111B 'succeed':102B 'vendor':43B 'versa':44B,46B,73B,108B 'vos':45B,64B 'vpn':112B 'vsmd':69B 'wan':42B 'whether':99B 'workaround':107B 'ztp':118B","search_c":"'access':276C,349C 'addit':314C 'address':326C 'affect':301C 'aka':153C 'also':331C 'appli':305C 'applianc':195C,256C 'attack':183C,191C 'auth':165C,201C 'authent':216C 'buffer':144C,156C,235C 'configur':262C,290C,303C,321C 'confirm':142C 'control':270C,308C,310C 'controller-staging-sdwan':269C 'craft':163C,197C 'crash':174C,248C 'creat':185C 'denial':179C,188C 'denial-of-servic':187C 'descript':159C 'endpoint':285C,298C 'fail':223C 'flexvnf':155C 'fqdn':329C 'gateway':313C 'hostnam':327C 'hub':309C 'id':230C,242C 'ike':164C,200C,215C,220C 'impact':259C,336C 'implement':150C 'interfac':209C,281C,294C 'internet':352C 'ip':325C 'ipsec':149C,264C,284C,288C,297C 'larger':232C 'list':340C 'malici':162C,199C 'negoti':222C 'node':261C,339C 'overflow':145C,157C 'overlay':293C 'packet':166C,202C 'peer':324C 'phase':217C 'process':173C,239C,252C 'profil':266C,289C,320C 'remot':229C,241C,275C 'remote-access-serv':274C 'result':176C,245C 'sa':221C 'sdwan':272C 'send':204C 'sent':168C 'server':277C 'servic':181C,190C 'site':316C,318C 'site-to-sit':315C 'size':226C,236C 'sse':312C 'stage':271C 'therebi':175C 'type':268C 'typic':304C 'use':237C,278C 'versa':140C,154C 'vos':152C,170C,194C,212C,255C,260C,338C 'vpn':265C,319C 'vsmd':172C,251C 'vulner':146C,158C,287C,332C,344C 'wan':208C,280C 'without':322C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107245","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107245","severity":null,"published_at":"2026-11-10T01:17:12+00:00","modified_at":"2026-11-10T01:17:12+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107245:2396","url":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29","severity":null,"published_at":"2026-11-10T01:37:43+00:00","modified_at":"2026-11-10T01:37:43+00:00","first_seen_at":"2026-11-10T01:37:43+00:00","fetched_at":"2026-11-10T01:37:43+00:00","note":"Read Versa's own bulletin (JS page, via browser). Versa lists malicious packets from named IP blocks, so exploited=true as attempts; severity CRITICAL per vendor. Fix is by build date, not version number; OffSeq says 23.1.2 (secondary, not used). Affected range string approximate; NVD page unreadable via WebFetch. X not checked.","cites":["https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"]}],"documents":[{"id":112476,"url":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29","title":"Versa Security Portal: CVE-2026-107245 IPsec buffer overflow in VOS","kind":"advisory","source":"analyst","publisher":null,"text":"Versa Security Portal bulletin for CVE-2026-107245 (planned disclosure Nov 9, 2026). Buffer overflow in IPsec implementation on VOS (Versa FlexVNF): crafted IKE Auth packet with Remote ID larger than buffer crashes vsmd -> DoS, sent to WAN interfaces. Impacted: VOS nodes with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as IPsec endpoint (overlay interface endpoints not affected); typically all Controllers, Hub Controllers, SSE Gateways. Site-to-site VPN profiles without peer IP/hostname/FQDN also vulnerable. Not vulnerable if not accessible from the Internet. Severity CRITICAL, CWE-121. Exploitation status: Versa is aware of malicious IPsec packets from 45.142.193.0/24, 102.135.43.0/24, 102.135.44.0/23, 102.135.46.0/24. Product status: 21.2.3 EOS, upgrade to 22.1.4; 22.1.2/22.1.3/22.1.4: versions before July 26, 2026 affected, July 26 2026 or later unaffected; 23.1.X: before August 3, 2026 affected, August 3 2026 or later unaffected. Workarounds: disable staging VPN profile on Controllers/Hub Controllers when ZTP over Internet not needed; set remote peer on site-to-site profiles; blackhole known source IPs.\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}