Versa VOSにセッション乗っ取りの脆弱性、修正版あり
Summary
Versa VOSのZTP用Node.jsサービスが予測されやすいセッションIDを発行し、他人のセッションを乗っ取られるおそれがあります。該当版を使う組織は、このサービスが有効かを確認し、修正版の適用か無効化を進めてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Versa VOSのZTP用Node.jsサービスが予測されやすいセッションIDを発行し、他人のセッションを乗っ取られるおそれがあります。該当版を使う組織は、このサービスが有効かを確認し、修正版の適用か無効化を進めてください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| VersaVOS |
21.1.1 – 21.2.3→ Not listed ≥ 22.1.2, < July 2, 2026→ July 2, 2026 ≥ 22.1.3, < July 2, 2026→ July 2, 2026 ≥ 22.1.4, < July 2, 2026→ July 2, 2026 ≥ 23.1.2, < Aug 3, 2026→ Aug 3, 2026 |
Not listed July 2, 2026 July 2, 2026 July 2, 2026 Aug 3, 2026 |
Original description The description as published by the source.
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.
Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web support@hackerone.com
- web nvd.nist.gov
- web github.com