Date: 08/28/2024
Severity: High
Summary
The Black Lotus Labs team at Lumen Technologies uncovered active exploitation of a zero-day vulnerability, CVE-2024-39717, in Versa Director servers. This flaw, announced on August 22, 2024, affects all Versa SD-WAN applications before version 22.1.4. Versa Director servers, crucial for managing network configurations, are targeted by threat actors due to their role in orchestrating SD-WAN functionality for ISPs and MSPs.
Indicators of Compromise (IOC) List
Hash |
4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Hash |
sha256hash IN ("4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37") |
Reference:
https://www.cisa.gov/news-events/alerts/2024/08/27/versa-networks-releases-advisory-vulnerability-versa-director-cve-2024-39717
https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/