Buffer Overflow Vulnerability in VOS IPsec Implementation by Versa Networks

CVE-2026-107245

What is CVE-2026-107245?

Versa Networks has identified a security vulnerability in its VOS product pertaining to a buffer overflow within the IPsec implementation. This vulnerability can be exploited when a malicious actor sends a specifically crafted IKE Auth packet to the VOS appliance, causing the vsmd process to crash. This results in a Denial of Service condition that affects nodes utilizing certain IPsec VPN profiles. In particular, devices configured with controller-staging-sdwan or remote-access-server profiles via a WAN interface are vulnerable, while configurations using overlay interfaces or not exposed to the Internet remain safe. It is critical for users to ensure the security of their VOS appliances to mitigate this risk.

References