CVE-2025-23169: XSS
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23169?
CVE-2025-23169 is categorized as a medium-severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2025-23169?
To fix CVE-2025-23169, ensure that input validation and sanitization are properly implemented for user interface customizations.
What type of vulnerability is CVE-2025-23169?
CVE-2025-23169 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the Versa Director SD-WAN orchestration platform.
Which software is affected by CVE-2025-23169?
CVE-2025-23169 affects the Versa Networks Versa Director SD-WAN orchestration platform.
Can CVE-2025-23169 lead to data theft?
Yes, CVE-2025-23169 can lead to data theft as it allows malicious users to execute scripts in the context of the user's session.