CVE-2025-23170
BaseFortify
Publication date: 2025-06-19
Last updated on: 2025-06-23
Assigner: HackerOne
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Versa Director SD-WAN orchestration platform, specifically in a Python script called shell-connect.py. It is vulnerable to command injection through the user argument, which means an attacker can execute arbitrary commands on the system by exploiting this flaw.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary commands on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. This could allow unauthorized access, data manipulation, or disruption of services.
What immediate steps should I take to mitigate this vulnerability?
There are no workarounds to disable the vulnerable GUI option. The immediate step is to upgrade Versa Director to one of the remediated software versions as recommended by Versa Networks.