CISA Adds Versa Networks Director Vulnerability to Known Exploited Vulnerabilities Catalogue

Introduction

On August 23, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of a newly identified vulnerability in Versa Networks Director to its Known Exploited Vulnerabilities Catalogue. This vulnerability, designated CVE-2024-39717, is now recognized as a significant threat due to active exploitation in the wild.

Report Overview

The CVE-2024-39717 vulnerability was revealed following a customer report and subsequent analysis by Versa Networks. The vulnerability, related to the Versa Director's graphical user interface (GUI), specifically involves misusing the "Change Favicon" option. This option allows authenticated users with administrative privileges to upload malicious files masquerading as image files. Although the exploit requires high-level access and authentication, the severity of this vulnerability cannot be understated, particularly given the potential for unauthorized file uploads.

The Versa Director vulnerability exploits the GUI customization feature available to users logged in with "Provider-Data-Center-Admin" or "Provider-Data-Center-System-Admin" roles. The malicious file, disguised with a .png extension, bypasses traditional security measures by appearing as a harmless image file. However, the vulnerability can only be exploited after a user with the necessary administrative credentials has successfully logged into the system.

While the exact technical mechanism of the exploit remains limited to those with high-level administrative access, the vulnerability is compounded by the potential for an attacker to bypass traditional security guidelines if they have not been properly implemented. Versa Networks has identified that failure to adhere to published firewall guidelines from 2015 and 2017 played a significant role in successfully exploiting this vulnerability.

The potential impact of CVE-2024-39717 is considerable, particularly for organizations relying on Versa Networks Director for managing their networks. Although the vulnerability's exploitation requires a highly privileged user to be logged in, the consequences of a successful attack could be devastating. It could allow attackers to execute unauthorized actions, access sensitive data, or disrupt network operations.

Versa Networks has confirmed one instance of exploitation reported by a customer, which underscores the real-world risk associated with this vulnerability. Additionally, unconfirmed reports based on backbone telemetry observations by a third-party provider have been made, indicating that this vulnerability may have broader implications than initially thought.

Insights and Analysis

Given the severity of CVE-2024-39717, CISA has strongly urged all organizations to prioritize remediating this vulnerability as part of their ongoing vulnerability management practices. This recommendation is particularly relevant for Federal Civilian Executive Branch (FCEB) agencies, which are mandated by Binding Operational Directive (BOD) 22-01 to address known exploited vulnerabilities by specified due dates.

To mitigate the risk posed by CVE-2024-39717, organizations using Versa Networks Director are advised to review their security configurations and ensure that all relevant firewall guidelines are implemented. Additionally, the timely application of updates and patches provided by Versa Networks is crucial to safeguard against potential exploitation.

In summary, CVE-2024-39717 represents a significant threat to organizations utilizing Versa Networks Director. Adding this vulnerability to CISA's Known Exploited Vulnerabilities Catalogue highlights the importance of proactive vulnerability management and adherence to security best practices to minimize exposure to cyber threats.

Indicators of Compromise (IOCs)

No specific Indicators of Compromise (IOCs) were provided in the source material.

MITRE ATT&CK

References

CISA Adds One Known Exploited Vulnerability to Catalog for Versa Networks Director | CISA

Cybersecurity and Infrastructure Security Agency CISA

CVE Website