Buffer Overflow Vulnerability Description
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS.
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance.
What is impacted?
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable.
What is not impacted?
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Versa | VOS | affected |
|
No data.
No data.
No data available yet.
Vendor Workaround
Disable the staging VPN profile on Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively required. Enable the profile only for the duration of device bootstrapping. For site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). If the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 10 Nov 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. What is impacted? VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. What is not impacted? The VOS nodes listed above are not vulnerable if they are not accessible from the Internet. | |
| Weaknesses | CWE-121 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-11-10T00:32:37.094Z
Reserved: 2026-10-07T15:00:00.550Z
Link: CVE-2026-107245
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-10T01:17:12.740
Modified: 2026-11-10T01:17:12.740
Link: CVE-2026-107245
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-121
Stack-based Buffer Overflow