high · CVSS v3 7.6

CVE-2026-107241

The CVE-2026-107241 flaw allows an attacker with network access to authenticate to the Node.js web service on Versa VOS appliances using def

Overview

The CVE-2026-107241 flaw allows an attacker with network access to authenticate to the Node.js web service on Versa VOS appliances using default credentials and perform provisioning actions. The service is only required during initial Zero Touch Provisioning and can be disabled afterward. If left enabled, the appliance is vulnerable to unauthorized configuration changes.

Description

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance. Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

Impact

The vulnerability compromises confidentiality by exposing default credentials, integrity by allowing unauthorized provisioning changes, and availability if the service is misused to disrupt operations. Network administrators and customers using VOS appliances are directly impacted.

Remediation

Disable the Node.js web service immediately after initial provisioning; change or remove default credentials; restrict network access to the provisioning interface to trusted IP ranges; apply any vendor patches that remove the service or strengthen authentication.

Risk context

Severity is high with a CVSS v3 score of 7.6. No EPSS data is available, but the flaw remains critical until the service is disabled or patched.

Affected products

  • Versa FlexVNF
  • VOS appliance
  • Versa VOS

Scores

Severity
high
CVSS v2
6.8
CVSS v3
7.6
CVSS v4
—
EPSS
—

default-credentials HTTP-Basic-Auth Zero-Touch-Provisioning VOS Versa Node.js service-disabling network-access

← All CVEs

Related CVEs

high

CVE-2026-125074

A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.

View analysis

high

CVE-2026-125076

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

View analysis

high

CVE-2026-125078

A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

View analysis

high

CVE-2026-125360

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.

View analysis