CVE-2026-107242
Versa VOS Session Identifier Predictability Vulnerability
Description
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
INFO
Published Date :
Nov. 10, 2026, 12:32 a.m.
Last Modified :
Nov. 10, 2026, 12:32 a.m.
Remotely Exploit :
No
Source :
hackerone
Affected Products
The following products are affected by CVE-2026-107242
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Disable the Node.js web service on the VOS appliance.
- Ensure the Node.js web service is not required post-provisioning.
- Follow vendor hardening guide recommendations for disabling services.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-107242 vulnerability anywhere in the article.