CVE-2026-107242
Received Received - Intake

Predictable Session ID in Versa VOS Node.js Web Service

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: HackerOne

Description
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-107242
EUVD
EUVD-2026-120628

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
versa vos *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-340 The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a Node.js web service on VOS devices used for Zero Touch Provisioning (ZTP). The service generates session IDs using UUID version 1, which is predictable because it relies on the system's date, time, and MAC address. Predictable session IDs allow attackers to hijack user sessions.

Detection Guidance

Check if the Node.js web service for ZTP is running on the VOS device. Look for active Node.js processes or services listening on typical ports used for provisioning. Verify if the service is enabled by checking system configuration files or service management commands like 'systemctl' or 'service'.

Impact Analysis

If exploited, an attacker could hijack a user's session by predicting their session ID. This could lead to unauthorized access to the VOS device or network, potentially allowing data theft, manipulation, or further attacks.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling session hijacking, which may lead to unauthorized access to sensitive data. Predictable session IDs could allow attackers to impersonate legitimate users, compromising data confidentiality and integrity required by these regulations.

Mitigation Strategies

Disable the Node.js web service for ZTP on the VOS device as recommended by Versa's security hardening guide. This can typically be done via service management commands or configuration changes. Ensure the service is not running and verify its status afterward.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...