The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh and postgres to the internet, alongside a host of other services. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Versa recommends the following security controls: 1) Change default passwords to complex passwords 2) Passwords must be complex with at least 8 characters that comprise of upper case, and lower case alphabets, as well as at at least one digit, and one special character 3) Passwords must be changed at least every 90 days 4) Password change history is checked to ensure that the at least the last 5 passwords must be used when changing password. 5) Review and audit logs for all authentication attempts to check for unauthorized/suspicious login attempts and enforce remediation steps.
The vulnerability results from the use of default, unchanged credentials (CWE-1188) on multiple system accounts. Versa Director by default exposes SSH and PostgreSQL services directly on a network interface accessible from the Internet. Since many accounts have sudo privileges and use the same default passwords, an attacker can gain remote, unauthorized access without any additional techniques. A proof of concept demonstrating the vulnerability was publicly disclosed by external security researchers.
An attacker can remotely and without authentication gain full access to the Versa Director system — including the PostgreSQL database and system shell with administrative (sudo) privileges, resulting in complete loss of confidentiality, integrity, and availability of the system.
All default passwords must be immediately changed to complex ones (minimum 8 characters: uppercase and lowercase letters, digit, special character) and network access to SSH and PostgreSQL services must be restricted to trusted IP addresses only. The vendor recommends password rotation every 90 days, verification of the last 5 passwords history, and regular review of authentication logs. Patches available from the vendor should be applied according to references (Versa Director version 22.1.4).
Versa Director software in versions where default credentials have not been changed; the vendor indicates version 22.1.4 as containing fixes — details in vendor references
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H