← Vulnerability feed

Vulnerability record · CVE-2025-23172 · published 19 June 2025

CVE-2025-23172: Versa-networks versa director server-side request forgery (ssrf) vulnerability

Versa Networks · Versa Director

The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

7.2 CVSS 3.1 High EPSS 1.1% · top 35.4% CWE-918 · Server-side request forgery (SSRF)
7.2CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
3 Sep 2026Last modified by NVD

Description

The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://security-portal.versa-networks.com/emailbulletins/68526e7bdc94d6b9f2faf71b Vendor Advisory
https://support.versa-networks.com/support/solutions/articles/23000024323-release-21-2-3 Product
https://support.versa-networks.com/support/solutions/articles/23000025680-release-22-1-2 Product
https://support.versa-networks.com/support/solutions/articles/23000026033-release-22-1-3 Product
https://support.versa-networks.com/support/solutions/articles/23000026708-release-22-1-4 Product

Track CVE-2025-23172 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.2CVE-2024-39717Versa Director GUI unrestricted file upload via favicon optionVersa Director's GUI lets a Provider-Data-Center-Admin or Provider-Data-Center-System-Admin customize the interface, including the "Change Favicon" o…KEVEPSS 4.0%analysed10.0CVE-2024-42450Versa-networks versa director hard-coded credentials vulnerabilityThe Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Ve…EPSS 0.58%9.8CVE-2025-24288Versa-networks versa director insecure default initialization vulnerabilityThe Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple acco…EPSS 0.47%9.8CVE-2019-25029Versa-networks versa director command injection vulnerabilityIn Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnera…EPSS 2.4%8.8CVE-2025-23168Versa-networks versa director authentication bypass by spoofing vulnerabilityThe Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS…EPSS 0.40%7.5CVE-2025-23173Versa-networks versa director information exposure vulnerabilityThe Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the …EPSS 0.62%7.2CVE-2025-23171Versa-networks versa director unrestricted file upload vulnerabilityThe Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit fil…EPSS 0.55%6.7CVE-2025-23170Versa-networks versa director command injection vulnerabilityThe Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2025-23172), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.