← Vulnerability feed

Vulnerability record · CVE-2025-23168 · published 19 June 2025

CVE-2025-23168: Versa-networks versa director authentication bypass by spoofing vulnerability

Versa Networks · Versa Director

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends that Director be upgraded to one of the remediated software versions.

8.8 CVSS 3.1 High EPSS 0.40% · top 68.9% CWE-290 · Authentication bypass by spoofing
8.8CVSS 3.1 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
17 Jun 2026Last modified by NVD

Description

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends that Director be upgraded to one of the remediated software versions.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715 Mailing ListVendor Advisory
https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3 Permissions RequiredRelease Notes
https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2 Permissions RequiredRelease Notes
https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3 Permissions RequiredRelease Notes
https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4 Permissions RequiredRelease Notes

Track CVE-2025-23168 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.2CVE-2024-39717Versa Director GUI unrestricted file upload via favicon optionVersa Director's GUI lets a Provider-Data-Center-Admin or Provider-Data-Center-System-Admin customize the interface, including the "Change Favicon" o…KEVEPSS 4.0%analysed10.0CVE-2024-42450Versa-networks versa director hard-coded credentials vulnerabilityThe Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Ve…EPSS 0.58%9.8CVE-2025-24288Versa-networks versa director insecure default initialization vulnerabilityThe Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple acco…EPSS 0.47%9.8CVE-2019-25029Versa-networks versa director command injection vulnerabilityIn Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnera…EPSS 2.4%7.5CVE-2025-23173Versa-networks versa director information exposure vulnerabilityThe Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the …EPSS 0.62%7.2CVE-2025-23171Versa-networks versa director unrestricted file upload vulnerabilityThe Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit fil…EPSS 0.55%7.2CVE-2025-23172Versa-networks versa director server-side request forgery (ssrf) vulnerabilityThe Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add W…EPSS 1.1%6.7CVE-2025-23170Versa-networks versa director command injection vulnerabilityThe Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2025-23168), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.