CVE-2026-107244: High severity Versa VOS vulnerability
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Node.js web service after the initial provisioning of the VOS appliance.
Node.js web service on VOS service status = disabled
Event History
Frequently Asked Questions
Which VOS devices are exposed to this issue?
Only devices with the Node.js web service still enabled are exposed. The service is used for URL-based Zero Touch Provisioning and is not required after provisioning is complete.
What does an attacker need to exploit it?
An unauthenticated attacker needs network access to the Node.js web service. Because the decryption key and IV are hardcoded and shared across VOS appliances, the attacker can compute a valid token and use it to obtain an authenticated session.
What can be done if patching is not immediately possible?
Disable the Node.js web service after initial provisioning is complete, as recommended in Versa's security hardening guidance. Devices where this service is disabled are not exploitable through this issue.