CVE-2024-39717 is a critical vulnerability affecting Versa Director, specifically within its GUI's "Change Favicon" option. This flaw, categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type), allows authenticated Provider-Data-Center-Admin or Provider-Data-Center-System-Admin users to upload malicious files disguised as PNG images. With a CVSS score of 7.2 (High), successful exploitation can lead to high impact on confidentiality, integrity, and availability, requiring high privileges but no user interaction. This vulnerability is actively exploited in the wild, with CISA adding it to its KEV catalog and multiple reports linking it to the Chinese Volt Typhoon threat actor, despite a lack of public exploit code.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
21.2.2CPE matchmatch criteria | cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:* | ||
21.2.3CPE matchmatch criteria | cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:* | ||
22.1.1CPE matchmatch criteria | cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:* | ||
22.1.2CPE matchmatch criteria | cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:* | ||
22.1.3CPE matchmatch criteria | cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.