CVE-2025-24288CWE-1188

CVE-2025-24288

Critical · published June 19, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

🔥 Default credentials galore! The Versa Director software exposes multiple services to the internet, creating a playground for attackers due to easily guessable login details. ⚠️ Think of it as leaving the back door of a secure building wide open with a sign that says, 'Welcome, come on in!' By default, anyone can waltz right through, especially when the keys (or passwords) are just lying around! An attacker could stroll into your system with admin-level access, snooping through sensitive data, making unauthorized changes, or even completely taking control. This could lead to a nightmare scenario where your entire network is compromised!

Put simply

Think of it as leaving the back door of a secure building wide open with a sign that says, 'Welcome, come on in!' By default, anyone can waltz right through, especially when the keys (or passwords) are just lying around! This vulnerability allows unauthorized access due to default credentials across multiple accounts, many of which have sudo privileges. With SSH and PostgreSQL services exposed by default, attackers can easily exploit these weaknesses to gain elevated access.

What to do

An attacker could stroll into your system with admin-level access, snooping through sensitive data, making unauthorized changes, or even completely taking control. This could lead to a nightmare scenario where your entire network is compromised! To mitigate this, urgently change all default passwords to complex ones that meet security guidelines: at least 8 characters with upper and lower-case letters, digits, and special characters. Implement regular password changes every 90 days, review authentication logs, and enforce a robust password history policy to ensure that the last 5 passwords aren't reused. 🛡️ You've got this! Follow these steps, and you'll lock down your system faster than a superhero saves the day! 🦸‍♂️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2025-06-19T04:15Z
Affected products (6)
ProductVersionsFixed in
versa-networks/versa_directorall versions—
versa-networks/versa_directorall versions—
versa-networks/versa_directorall versions—
versa-networks/versa_directorall versions—
versa-networks/versa_directorall versions—
versa-networks/versa_directorall versions—
References (2)
EPSS history
Timeline
  • 18 JUN 23:30Z
    The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most…
    cvelistv5