{"api_version":"1","generated_at":"2026-11-11T14:57:19+00:00","cve":"CVE-2026-107242","urls":{"html":"https://cve.report/CVE-2026-107242","api":"https://cve.report/api/cve/CVE-2026-107242.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-107242","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107242"},"summary":{"title":"CVE-2026-107242","description":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.","state":"PUBLISHED","assigner":"hackerone","published_at":"2026-11-10 01:17:12","updated_at":"2026-11-10 01:17:12"},"problem_types":["CWE-340","CWE-340 CWE-340 Generation of Predictable Numbers or Identifiers"],"metrics":[],"references":[{"url":"https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836","name":"https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836","refsource":"support@hackerone.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107242","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107242","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Versa","product":"VOS","version":"affected 21.1.1 21.2.3 semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"affected 22.1.2 July 2, 2026 semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"affected 22.1.3 July 2, 2026 semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"affected 22.1.4 July 2, 2026 semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"affected 23.1.2 Aug 3, 2026 semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"unaffected 22.1.2 July-2-2026-Hotfix 22.1.2 July-2-2026-Hotfix semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"unaffected 22.1.3 July-2-2026-Hotfix 22.1.3 July-2-2026-Hotfix semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"unaffected 22.1.4 July-2-2026-Hotfix 22.1.4 July-2-2026-Hotfix semver","platforms":[]},{"source":"CNA","vendor":"Versa","product":"VOS","version":"unaffected 23.1.2 Aug-3-2026-Hotfix 23.1.2 Aug-3-2026-Hotfix semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"NCSC Netherlands","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"Aug 3, 2026","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"NCSC Netherlands"}],"descriptions":[{"lang":"en","value":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-340","description":"CWE-340 Generation of Predictable Numbers or Identifiers","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T00:32:37.037Z","orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","shortName":"hackerone"},"references":[{"url":"https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"}],"workarounds":[{"lang":"en","value":"The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"}]}},"cveMetadata":{"assignerOrgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","assignerShortName":"hackerone","cveId":"CVE-2026-107242","datePublished":"2026-11-10T00:32:37.037Z","dateReserved":"2026-10-07T15:00:00.550Z","dateUpdated":"2026-11-10T00:32:37.037Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 01:17:12","lastModifiedDate":"2026-11-10 01:17:12","problem_types":["CWE-340","CWE-340 CWE-340 Generation of Predictable Numbers or Identifiers"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"107242","Ordinal":"1","Title":"CVE-2026-107242","CVE":"CVE-2026-107242","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"107242","Ordinal":"1","NoteData":"The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. \n\nVersa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.","Type":"Description","Title":"CVE-2026-107242"}]}}}