← Vulnerability feed

Vulnerability record · CVE-2025-23171 · published 19 June 2025

CVE-2025-23171: Versa-networks versa director unrestricted file upload vulnerability

Versa Networks · Versa Director

The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

7.2 CVSS 3.1 High EPSS 0.55% · top 56.2% CWE-434 · Unrestricted file upload
7.2CVSS 3.1 base score
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
25 Aug 2026Last modified by NVD

Description

The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security-portal.versa-networks.com/emailbulletins/68526dbbdc94d6b9f2faf71a Vendor Advisory
https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3 Permissions Required
https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2 Permissions Required
https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3 Permissions Required
https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4 Permissions Required

Track CVE-2025-23171 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.2CVE-2024-39717Versa Director GUI unrestricted file upload via favicon optionVersa Director's GUI lets a Provider-Data-Center-Admin or Provider-Data-Center-System-Admin customize the interface, including the "Change Favicon" o…KEVEPSS 4.0%analysed10.0CVE-2024-42450Versa-networks versa director hard-coded credentials vulnerabilityThe Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Ve…EPSS 0.58%9.8CVE-2025-24288Versa-networks versa director insecure default initialization vulnerabilityThe Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple acco…EPSS 0.47%9.8CVE-2019-25029Versa-networks versa director command injection vulnerabilityIn Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnera…EPSS 2.4%8.8CVE-2025-23168Versa-networks versa director authentication bypass by spoofing vulnerabilityThe Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS…EPSS 0.40%7.5CVE-2025-23173Versa-networks versa director information exposure vulnerabilityThe Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the …EPSS 0.62%7.2CVE-2025-23172Versa-networks versa director server-side request forgery (ssrf) vulnerabilityThe Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add W…EPSS 1.1%6.7CVE-2025-23170Versa-networks versa director command injection vulnerabilityThe Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2025-23171), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.