CVE-2026-107243: High severity Versa VOS vulnerability
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Node.js web service after initial provisioning of the VOS appliance.
VOS Node.js web service Node.js web service status = disabled
Event History
Frequently Asked Questions
Which VOS devices are exposed to this issue?
Only VOS devices with the Node.js web service enabled are exposed. The service is used for URL-based Zero Touch Provisioning and is not required after provisioning is complete.
What does an attacker need to exploit the issue?
An attacker needs to obtain a valid session ID from any source. They can then use the shared hardcoded secret to calculate a valid HMAC-SHA256 signature and forge a session cookie.
Can a cookie forged for one appliance be used against another appliance?
Yes. The session-signing secret is identical across all VOS appliances, so a forged cookie accepted by one appliance can be accepted by any VOS appliance in the deployment.
What mitigation is available if the service is no longer needed?
Disable the Node.js web service after initial provisioning. Versa’s hardening guidance recommends this for Hubs, Branches, and Controllers, and the issue is not exploitable when the service is disabled.