CVE-2026-107245

Full vulnerability record from the local CVENow database.

Description

Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.  Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. What is impacted? VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. What is not impacted? The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-10 01:17:12.740000

Last modified

2026-11-10 01:17:12.740000

View original CVE JSON

{
  "id": "CVE-2026-107245",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-10T01:17:12.740",
  "lastModified": "2026-11-10T01:17:12.740",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. \n \n Buffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. \n \nDuring the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted?  \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Versa",
          "product": "VOS",
          "versions": [
            {
              "version": "21.1.1",
              "lessThanOrEqual": "21.2.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "22.1.2",
              "lessThan": "July 2, 2026",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "22.1.3",
              "lessThan": "July 2, 2026",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "22.1.4",
              "lessThan": "July 2, 2026",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "23.1.2",
              "lessThan": "23.1.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "22.1.2 July-2-2026-Hotfix",
              "lessThan": "22.1.2 July-2-2026-Hotfix",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "22.1.3 July-2-2026-Hotfix",
              "lessThan": "22.1.3 July-2-2026-Hotfix",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "22.1.4 July-2-2026-Hotfix",
              "lessThan": "22.1.4 July-2-2026-Hotfix",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "23.1.2 Aug-3-2026-Hotfix",
              "lessThan": "23.1.2 Aug-3-2026-Hotfix",
              "versionType": "semver",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29",
      "source": "[email protected]"
    }
  ]
}