Authentication Bypass in VOS Node.js Web Service by Versa Networks

CVE-2026-107244

What is CVE-2026-107244?

The Node.js web service embedded in the VOS (formerly Versa FlexVNF) is crucial for URL-based Zero Touch Provisioning (ZTP) during the initial device setup. However, post-provisioning, it serves no purpose and can be a vulnerability if left enabled. The /decryptTest endpoint exposes a significant flaw where an attacker can gain an authenticated session without credentials by utilizing a hardcoded key and initialization vector for decryption. This flaw allows unauthorized access to the system, making it imperative for users to disable the Node.js service after provisioning to mitigate the risk. Versa Networks' security hardening guide recommends this measure for all VOS deployments.

References