Session Hijacking Vulnerability in VOS by Versa Networks

CVE-2026-107242

What is CVE-2026-107242?

The Node.js web service in VOS, utilized for URL-based Zero Touch Provisioning, is critical to the provisioning process. However, after provisioning is completed, this service is unnecessary and poses a security risk. It generates session identifiers using UUID version 1, which are predictable due to their reliance on the system's MAC address and the current date and time. If an attacker can predict a user's session ID, they can potentially hijack the session. To mitigate this risk, it is recommended to disable the Node.js web service post-provisioning, ensuring that the device is secure from session hijacking attempts.

References