CVE-2026-107243

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after…

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-107243