Versa Networks Releases Advisory for a Vulnerability in Versa Director, CVE-2024-39717

Date: 08/28/2024

Severity: High

Summary

The Black Lotus Labs team at Lumen Technologies uncovered active exploitation of a zero-day vulnerability, CVE-2024-39717, in Versa Director servers. This flaw, announced on August 22, 2024, affects all Versa SD-WAN applications before version 22.1.4. Versa Director servers, crucial for managing network configurations, are targeted by threat actors due to their role in orchestrating SD-WAN functionality for ISPs and MSPs.

Indicators of Compromise (IOC) List

4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37 

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

sha256hash IN ("4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37")

Reference:

CISA Alert on Versa Director Vulnerability CVE-2024-39717  

Lumen Analysis of Zero-Day Exploitation of Versa Director