CVE-2025-23170: Command Injection
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23170?
CVE-2025-23170 has been rated as a high severity vulnerability due to its exploitation allowing command injection.
How do I fix CVE-2025-23170?
To fix CVE-2025-23170, it is recommended to apply patches provided by Versa Networks for the affected Director SD-WAN orchestration platform.
What systems are affected by CVE-2025-23170?
CVE-2025-23170 affects the Versa Networks Director orchestration platform.
What is the impact of exploiting CVE-2025-23170?
Exploiting CVE-2025-23170 allows attackers to execute arbitrary commands on remote CPEs through the vulnerable SSH functionality.
When was CVE-2025-23170 disclosed?
CVE-2025-23170 was disclosed in 2025 as a significant security vulnerability affecting Versa Networks Director.