Node.js Web Service Vulnerability in Versa Networks VOS Appliance
CVE-2026-107241

7.6HIGH

Key Information:

Vendor

Versa

Status
Vos
Vendor
CVE Published:
10 November 2026

What is CVE-2026-107241?

The Node.js web service on Versa Networks' VOS appliance, used for URL-based Zero Touch Provisioning, retains default credentials for authentication. An attacker with network access who can leverage these default credentials can gain unauthorized access to perform provisioning actions. It is crucial to follow security guidelines by disabling the Node.js web service once the initial provisioning is complete to mitigate potential risks associated with this vulnerability.

Affected Version(s)

VOS 21.1.1 <= 21.2.3

VOS 22.1.2

VOS 22.1.3

References

https://security-portal.versa-networks.com/emailbulletins...

CVSS V3.0

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NCSC Netherlands
.