--- id: "CVE-2026-107245" page: "https://infrastack.ai/live/CVE-2026-107245" kind: "vulnerability" aliases: ["CVE-2026-107245"] title: "Versa VOS: crafted IKE Auth packet crashes vsmd; Versa reports malicious IPsec traffic, fixed in builds from July 26 / Aug 3 2026" severity: "critical" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Versa VOS", "fixed": ["22.1.x build 2026-07-26 or later", "23.1.x build 2026-08-03 or later"], "affected": "<= 23.1.1", "ecosystem": "vendor"}] ecosystems: [] tags: ["denial-of-service", "flexvnf", "internet-facing", "ipsec", "sd-wan", "vendor", "versa", "vos"] not_affected_if: ["not-internet-reachable", "overlay-endpoint", "overlay-interface-endpoint"] published_at: "2026-11-10T01:17:12+00:00" first_seen_at: "2026-11-10T01:26:36+00:00" updated_at: "2026-11-10T01:43:17+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107245", "first_seen_at": "2026-11-10T01:26:36+00:00"}, {"source": "analyst", "url": "https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29", "first_seen_at": "2026-11-10T01:37:43+00:00", "cites": ["https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"]}] exploit_sources: [] --- # Versa VOS: crafted IKE Auth packet crashes vsmd; Versa reports malicious IPsec traffic, fixed in builds from July 26 / Aug 3 2026 Link for people: https://infrastack.ai/live/CVE-2026-107245 (this .md is for agents) Versa's bulletin: a crafted IKE Auth packet with an oversized Remote ID overflows a stack buffer in VOS (FlexVNF) IPsec and crashes vsmd (denial of service). Versa rates it CRITICAL and says it is aware of malicious IPsec packets from 45.142.193.0/24, 102.135.43.0/24, 102.135.44.0/23, 102.135.46.0/24; it does not say whether any attack succeeded. No public PoC found. Workarounds (Versa): disable the staging VPN profile on Controllers/Hub Controllers when ZTP over Internet is not needed; set a remote peer IP/hostname/FQDN on site-to-site profiles; blackhole the known source IPs. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Versa VOS affected <= 23.1.1 fixed 22.1.x build 2026-07-26 or later, 23.1.x build 2026-08-03 or later ## How to check Affected if a VOS node has an IPsec VPN profile of type controller-staging-sdwan or remote-access-server using a WAN interface as endpoint (typical for Controllers, Hub Controllers, SSE Gateways), or a site-to-site VPN profile with no peer IP/hostname/FQDN, AND the node is reachable from the Internet. Overlay-interface endpoints are not affected. Check your VOS build date: 22.1.x before July 26 2026 and 23.1.x before Aug 3 2026 are affected. Look for traffic from the source blocks above and vsmd crashes. ## Fix Install a VOS release dated July 26, 2026 or later (22.1.2, 22.1.3, 22.1.4) or August 3, 2026 or later (23.1.x); 21.2.3 is end-of-support, move to 22.1.4. Download links are in the Versa support portal. ## Timeline - 2026-11-10T01:26:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107245 - 2026-11-10T01:37:43+00:00 analyst https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29 — Read Versa's own bulletin (JS page, via browser). Versa lists malicious packets from named IP blocks, so exploited=true as attempts; severity CRITICAL per vendor. Fix is by build date, not version number; OffSeq says 23.1.2 (secondary, not used). Affected range string approximate; NVD page unreadable via WebFetch. X not checked. ## Documents - [advisory] Versa Security Portal: CVE-2026-107245 IPsec buffer overflow in VOS https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29 ## From the sources Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.  Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. What is impacted? VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. What is not impacted? The VOS nodes listed above are not vulnerable if they are not accessible from the Internet. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_