CVE-2024-45229

Summary

CVE	CVE-2024-45229
State	PUBLISHED
Assigner	hackerone
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-09-20 19:15:16 UTC
Updated	2026-08-25 14:28:04 UTC
Description	The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can be exploited by injecting invalid arguments into a GET request, potentially exposing the authentication tokens of other currently logged-in users. These tokens can then be used to invoke additional APIs on port 9183. This exploit does not disclose any username or password information. Currently, there are no workarounds in Versa Director. However, if there is Web Application Firewall (WAF) or API Gateway fronting the Versa Director, it can be used to block access to the URLs of vulnerable API. /vnms/devicereg/device/* (on ports 9182 & 9183) and /versa/vnms/devicereg/device/* (on port 443). Versa recommends that Directors be upgraded to one of the remediated software versions. This vulnerability is not exploitable on Versa Directors not exposed to the Internet.We have validated that no Versa-hosted head ends have been affected by this vulnerability. Please contact Versa Technical Support or Versa account team for any further assistance.

Primary CVSS: v3.0 6.6 MEDIUM from [email protected]

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.005090000 probability, percentile 0.411590000 (date 2026-08-25)

Problem Types: CWE-306 | CWE-306 CWE-306 Missing Authentication for Critical Function

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Secondary	6.6	MEDIUM	`CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H`
3.0	CNA	DECLARED	6.6	MEDIUM	`CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H`

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Application	Versa-networks	Versa Director	21.2.2	All	All	All
Application	Versa-networks	Versa Director	21.2.3	-	All	All
Application	Versa-networks	Versa Director	22.1.1	All	All	All
Application	Versa-networks	Versa Director	22.1.2	-	All	All
Application	Versa-networks	Versa Director	22.1.3	-	All	All
Application	Versa-networks	Versa Director	22.1.4	-	All	All

Source	Vendor	Product	Version	Platforms
CNA	Versa	Director	affected 22.1.4 20240909 22.1.4 20240909 custom	Not specified
CNA	Versa	Director	affected 22.1.3 20240909 22.1.3 20240909 custom	Not specified
CNA	Versa	Director	affected 22.1.2 20240909 22.1.2 20240909 custom	Not specified
CNA	Versa	Director	affected 22.1.1 20240909 22.1.1 20240909 custom	Not specified
CNA	Versa	Director	affected 21.2.3 20240909 21.2.3 20240909 custom	Not specified
CNA	Versa	Director	affected 21.2.2 20240909 21.2.2 20240909 custom	Not specified
ADP	Versa	Director	affected 22.1.4	Not specified
ADP	Versa	Director	affected 22.1.3	Not specified
ADP	Versa	Director	affected 22.1.2	Not specified
ADP	Versa	Director	affected 22.1.1	Not specified
ADP	Versa	Director	affected 21.2.3	Not specified
ADP	Versa	Director	affected 21.2.2	Not specified

Reference	Source	Link	Tags
security-portal.versa-networks.com/emailbulletins/66e4a8ebda545d61ec2b1ab9	[email protected]	security-portal.versa-networks.com	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.