Versa Networks vulnerabilities (CVEs)

2 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

• CVE-2025-23172 ↗EPSS 1.1%LEV ≥15%Elevated risk

  The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and…

• CVE-2024-42450 ↗EPSS 0.6%LEV ≥13%Elevated risk

  The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Directo…

• CVE-2024-45208 ↗EPSS 0.9%LEV ≥12%Elevated risk

  The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 …

• CVE-2025-23172 is now estimated at a 14% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
• CVE-2024-42450 is now estimated at a 12% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2024-45208 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗
• CVE-2025-23172 is now estimated at a 13% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-08-31 · NVD ↗

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

• CVE-2025-24291 ↗MEDIUM 6.12025

  The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the Java code handling file uploads contains an argument injection vulnerability. By …

• CVE-2025-24288 ↗CRITICAL 9.82025

  The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same …

• ↗

• CVEs come from the US National Vulnerability Database (NVD) and are matched to Versa Networks by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-11.
• Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
• Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.