Command Injection Vulnerability in VOS Node.js Web Service by Versa Networks

CVE-2026-107240

What is CVE-2026-107240?

The Node.js web service used in the VOS (previously known as Versa FlexVNF) for URL-based Zero Touch Provisioning has a command injection vulnerability. This weakness arises from the /authenticate endpoint, which improperly handles user-supplied input by allowing newline characters, thereby enabling an unauthenticated attacker to execute arbitrary shell commands as the versa OS service user. It is crucial to note that the exploitation requires only a CSRF token obtainable through an unauthenticated page load. To mitigate this risk, Versa Networks recommends disabling the Node.js web service post-provisioning.

References