Descripción
The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
Acción recomendada
Aplicar las mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de versa-networks.com versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39…
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2024-39717
Otras vulnerabilidades de Versa en el catálogo
- CVE-2025-34026 Vulnerabilidad de autenticación incorrecta en Versa Concerto Alta 22-01-2026