CVE-2026-107241
Received Received - Intake

Default Credentials Authentication Bypass in Versa VOS Node.js Web Service

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: HackerOne

Description
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-107241
EUVD
EUVD-2026-120627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
versa vos *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1390 The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a Node.js web service on VOS (Versa FlexVNF) used for Zero Touch Provisioning (ZTP). The service uses default credentials and HTTP Basic Authentication, allowing attackers with network access to authenticate and perform provisioning actions if they know the default credentials.

Detection Guidance

Check if the Node.js web service for VOS ZTP is running on your network. Look for open ports typically used by web services (e.g., 80, 443, or custom ports). Verify if default credentials are enabled or if HTTP Basic Authentication is active on the service.

Impact Analysis

An attacker could gain unauthorized access to the VOS appliance, perform provisioning actions, and potentially take control of the device. This could lead to data breaches, unauthorized configuration changes, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be compromised if default credentials are not changed or the service is not disabled after provisioning.

Mitigation Strategies

Disable the Node.js web service for ZTP on the VOS appliance as recommended by Versa's security hardening guide. Ensure default credentials are changed or removed and restrict access to the service via network controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...