CVE-2026-107245
Summary
| CVE | CVE-2026-107245 |
|---|---|
| State | PUBLISHED |
| Assigner | hackerone |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-10 01:17:12 UTC |
| Updated | 2026-11-10 01:17:12 UTC |
| Description | Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. What is impacted? VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. What is not impacted? The VOS nodes listed above are not vulnerable if they are not accessible from the Internet. |
Risk And Classification
Problem Types: CWE-121 | CWE-121 CWE-121 Stack Overflow
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Versa | VOS | affected 21.1.1 21.2.3 semver | Not specified |
| CNA | Versa | VOS | affected 22.1.2 July 2, 2026 semver | Not specified |
| CNA | Versa | VOS | affected 22.1.3 July 2, 2026 semver | Not specified |
| CNA | Versa | VOS | affected 22.1.4 July 2, 2026 semver | Not specified |
| CNA | Versa | VOS | affected 23.1.2 23.1.2 semver | Not specified |
| CNA | Versa | VOS | unaffected 22.1.2 July-2-2026-Hotfix 22.1.2 July-2-2026-Hotfix semver | Not specified |
| CNA | Versa | VOS | unaffected 22.1.3 July-2-2026-Hotfix 22.1.3 July-2-2026-Hotfix semver | Not specified |
| CNA | Versa | VOS | unaffected 22.1.4 July-2-2026-Hotfix 22.1.4 July-2-2026-Hotfix semver | Not specified |
| CNA | Versa | VOS | unaffected 23.1.2 Aug-3-2026-Hotfix 23.1.2 Aug-3-2026-Hotfix semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29 | [email protected] | security-portal.versa-networks.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Workarounds
CNA: Disable the staging VPN profile on Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively required. Enable the profile only for the duration of device bootstrapping. For site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). If the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic.
There are currently no legacy QID mappings associated with this CVE.