CVE-2024-39717: Versa Director GUI unrestricted file upload via favicon option

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is a high-severity unrestricted upload in an administrative interface and is listed in CISA KEV as exploited in the wild, though it requires prior privileged authentication.

What it is

Versa Director's GUI lets a Provider-Data-Center-Admin or Provider-Data-Center-System-Admin customize the interface, including the "Change Favicon" option. That option fails to properly restrict uploaded file types, so a file ending in .png can be uploaded and used to masquerade as an image while actually being malicious. Because the flaw is an unrestricted upload (CWE-434) in an administrative interface, it matters as a potential path to code execution or system compromise on the Director appliance.

Impact

An attacker who already holds a Provider-Data-Center-Admin or Provider-Data-Center-System-Admin account can upload a malicious file disguised as a .png, potentially gaining code execution or otherwise compromising the Versa Director system.

Attack surface

The flaw is reached over the network through the Versa Director GUI's favicon customization feature. It requires a valid authenticated session with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges; tenant-level users cannot reach it, and no user interaction beyond the upload is described.

Exploitation

CVE-2024-39717 was added to CISA KEV on 2024-08-23 with a remediation due date of 2024-09-13, indicating known exploitation in the wild. EPSS gives a 30-day probability of about 4.0% (90th percentile), and the vendor advisory and KEV listing are the only references provided.

What to do

• Apply the vendor's patched Versa Director release or the mitigations in the Versa security bulletin as soon as possible.
• If patching is not immediately possible, restrict or disable the favicon customization feature and follow CISA KEV guidance, including discontinuing use if no mitigation exists.
• Limit Provider-Data-Center-Admin and Provider-Data-Center-System-Admin accounts to the minimum necessary personnel and enforce strong authentication.
• Monitor and audit administrative accounts for unexpected creation or privilege changes that could enable this upload.
• Review uploaded favicon files for content that does not match a valid image format.

Detection

• Monitor Versa Director logs for favicon upload events and inspect uploaded files for non-image content or embedded code.
• Alert on administrative account activity outside normal change windows, especially uploads to the GUI customization feature.
• Hunt for suspicious files with .png extensions in Director web directories that fail image parsing or contain executable content.
• Correlate Director administrative logins with subsequent process execution or outbound connections from the appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.