CVE-2026-107242

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107242", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-10-07T15:00:00.550Z", "datePublished": "2026-11-10T00:32:37.037Z", "dateUpdated": "2026-11-12T13:31:09.492Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system\u2019s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user\u2019s session ID could hijack that user\u2019s session.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}], "affected": [{"vendor": "Versa", "product": "VOS", "versions": [{"version": "21.1.1", "status": "affected", "lessThanOrEqual": "21.2.3", "versionType": "semver"}, {"version": "22.1.2", "status": "affected", "lessThan": "July 2, 2026", "versionType": "semver"}, {"version": "22.1.3", "status": "affected", "lessThan": "July 2, 2026", "versionType": "semver"}, {"version": "22.1.4", "status": "affected", "lessThan": "July 2, 2026", "versionType": "semver"}, {"version": "23.1.2", "status": "affected", "lessThan": "Aug 3, 2026", "versionType": "semver"}, {"version": "22.1.2 July-2-2026-Hotfix", "status": "unaffected", "lessThan": "22.1.2 July-2-2026-Hotfix", "versionType": "semver"}, {"version": "22.1.3 July-2-2026-Hotfix", "status": "unaffected", "lessThan": "22.1.3 July-2-2026-Hotfix", "versionType": "semver"}, {"version": "22.1.4 July-2-2026-Hotfix", "status": "unaffected", "lessThan": "22.1.4 July-2-2026-Hotfix", "versionType": "semver"}, {"version": "23.1.2 Aug-3-2026-Hotfix", "status": "unaffected", "lessThan": "23.1.2 Aug-3-2026-Hotfix", "versionType": "semver"}]}], "references": [{"url": "https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}], "credits": [{"lang": "en", "value": "NCSC Netherlands", "type": "finder"}], "workarounds": [{"lang": "en", "value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-11-10T00:32:37.037Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T13:30:45.489761Z", "id": "CVE-2026-107242", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T13:31:09.492Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "VOS", "vendor": "Versa", "versions": [{"lessThanOrEqual": "21.2.3", "status": "affected", "version": "21.1.1", "versionType": "semver"}, {"lessThan": "July 2, 2026", "status": "affected", "version": "22.1.2", "versionType": "semver"}, {"lessThan": "July 2, 2026", "status": "affected", "version": "22.1.3", "versionType": "semver"}, {"lessThan": "July 2, 2026", "status": "affected", "version": "22.1.4", "versionType": "semver"}, {"lessThan": "Aug 3, 2026", "status": "affected", "version": "23.1.2", "versionType": "semver"}, {"lessThan": "22.1.2 July-2-2026-Hotfix", "status": "unaffected", "version": "22.1.2 July-2-2026-Hotfix", "versionType": "semver"}, {"lessThan": "22.1.3 July-2-2026-Hotfix", "status": "unaffected", "version": "22.1.3 July-2-2026-Hotfix", "versionType": "semver"}, {"lessThan": "22.1.4 July-2-2026-Hotfix", "status": "unaffected", "version": "22.1.4 July-2-2026-Hotfix", "versionType": "semver"}, {"lessThan": "23.1.2 Aug-3-2026-Hotfix", "status": "unaffected", "version": "23.1.2 Aug-3-2026-Hotfix", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system\u2019s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user\u2019s session ID could hijack that user\u2019s session.\u00a0\n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."}], "id": "CVE-2026-107242", "lastModified": "2026-11-12T19:09:06.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107242", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T13:30:45.489761Z", "version": "2.0.3"}}]}, "published": "2026-11-10T01:17:12.337", "references": [{"source": "support@hackerone.com", "url": "https://security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-340"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.1.1,21.2.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,July 2, 2026)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,July 2, 2026)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,July 2, 2026)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Aug 3, 2026)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[22.1.2 July-2-2026-Hotfix,22.1.2 July-2-2026-Hotfix]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[22.1.3 July-2-2026-Hotfix,22.1.3 July-2-2026-Hotfix]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[22.1.4 July-2-2026-Hotfix,22.1.4 July-2-2026-Hotfix]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[23.1.2 Aug-3-2026-Hotfix,23.1.2 Aug-3-2026-Hotfix]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "VOS", "source": "cna", "vendor": "Versa"}, "product": "vos", "vendor": "versa"}], "created": "2026-11-10T02:00:13.294219+00:00", "title": "Predictable Session ID Generation in Versa VOS Node.js Web Service Enables Session Hijacking", "updated": "2026-11-10T09:28:14.925439+00:00", "vendors": ["versa", "versa$PRODUCT$vos"]}