CVE-2025-24288: Critical severity Versa Networks Versa Director vulnerability
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends the following security controls: 1) Change default passwords to complex passwords 2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character 3) Passwords must be changed at least every 90 days 4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password. 5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change any default passwords to complex passwords meeting the stated complexity requirements.
Versa Director authentication default password policy (complexity) = Use complex passwords: minimum 8 characters; include at least one uppercase letter, one lowercase letter, at least one digit, and at least one special character - Configuration
Enforce password changes at least every 90 days.
Versa Director authentication password rotation interval = 90 days - Configuration
When changing passwords, check password history so the last 5 passwords must be used and prevented from reuse (i.e., ensure at least the last 5 cannot be reused).
Versa Director authentication password history / reuse restriction = block reuse of last 5 passwords - Compensating control
Review and audit logs for all authentication attempts to detect unauthorized/suspicious login attempts and enforce the appropriate remediation steps.
- Compensating control
Restrict Versa Director exposure by not leaving default services (SSH and Postgres) exposed to the internet; limit access using network controls (e.g., firewall/ACL) so only required clients can reach these services.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24288?
CVE-2025-24288 is classified as a high severity vulnerability due to its potential for unauthorized access and exploitation.
How do I fix CVE-2025-24288?
To fix CVE-2025-24288, users should update Versa Director to the latest version and change default credentials for all accounts.
What are the risks associated with CVE-2025-24288?
The risks include the exposure of sensitive services and potential unauthorized access due to default credentials.
Which services are exposed by CVE-2025-24288?
CVE-2025-24288 exposes services such as SSH and PostgreSQL to the internet by default.
What should I do if I cannot immediately patch CVE-2025-24288?
If immediate patching is not possible for CVE-2025-24288, secure your environment by disabling exposed services and changing default credentials.