Versa Director Dangerous File Type Upload Vulnerability

The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data

The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access)…

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS

The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI

The Versa Director SD-WAN orchestration platform provides an option to upload various types of files

The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints

The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box

The Versa Director offers REST APIs for orchestration and management

The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files

The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo

A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8

In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage

In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files

In Versa Director, the un-authentication request found