Versa security bulletin: Update on CVE-2024-39717 – Versa Director dangerous file type upload vulnerability

Patch status, affected versions, and hardening steps for CVE-2024-39717 – a high-severity file upload flaw exploited by APT actors in the wild.

Versa Security Research Team
By Versa Security Research Team
Threat Research & Protection Team
  • Read Time: 6 min
  • Published: August 26, 2024
  • Modified: November 5, 2026
  • 6 read
  • August 26, 2024
  • November 5, 2026

Summary

A high-severity vulnerability tracked as CVE-2024-39717 in Versa Director enables privilege escalation through malicious file uploads, primarily targeting managed service providers. Exploitation occurred where published firewall and system hardening guidelines were not implemented. Versa has released patches and is actively working with all affected customers to apply remediation and harden their environments.

  • CVE-2024-39717 allows users with Provider-Data-Center-Admin privileges to upload potentially malicious files to Versa Director systems.
  • At least one Advanced Persistent Threat actor has exploited this vulnerability, prompting CISA to add it to its Known Exploited Vulnerabilities catalog.
  • Impacted customers had not applied Versa's firewall and system hardening guidelines, leaving management ports exposed to the internet.
  • Customers should inspect the /var/versa/vnms/web/custom_logo/ directory for suspicious uploaded files to determine if exploitation has occurred.
  • Upgrading Versa Director to version 22.1.4 or applying the June 21, 2024 hot fix for earlier versions remediates the vulnerability.

What happened

CVE-2024-39717 is a dangerous file type upload vulnerability in Versa Director. It allowed users holding Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to upload potentially malicious files, creating a path to privilege escalation.

Exploitation depended on two conditions being true at the same time:

  • The attacker already held Provider-Data-Center-Admin or Provider-Data-Center-System-Admin credentials
  • The Versa Director management port was reachable from the internet

The second condition is what separated impacted customers from unaffected ones. Versa has published Firewall Requirements since 2015 and System Hardening recommendations since 2017, and both restrict management port exposure. Customers who were impacted had not implemented those guidelines, which left a management port exposed on the internet and gave threat actors their initial access.

What is the exploitation status of CVE-2024-39717?

CVE-2024-39717 has been exploited in at least one known instance by an Advanced Persistent Threat actor and has been added to CISA’s Known Exploited Vulnerabilities catalog. While difficult to exploit, it carries a “High” severity rating and affects all Versa SD-WAN customers running Versa Director who have not applied the published system hardening and firewall guidelines.

CISA has added this vulnerability to its “Known Exploited Vulnerabilities” list (CVE-2024-39717).

Affected systems and versions

Versa Director:

Versions Affected Unaffected
22.1.4 None All
22.1.3 22.1.3 images released before June 21, 2024 hot fix. 22.1.3 June 21, 2024 Hot Fix and later.
22.1.2 22.1.2 image released before June 21, 2024 hot fix. 22.1.2 June 21, 2024 Hot Fix and later.
22.1.1 All None. Please upgrade to 22.1.3 latest version.
21.2.3 21.2.3 images released before June 21, 2024 hot fix. 21.2.3 June 21, 2024 and later.
21.2.2 All None. Please upgrade to 21.2.3 latest version.

What should Versa customers do?

Versa customers should take three immediate actions: apply the published system hardening and firewall best practices, upgrade Director to a remediated software version, and inspect their systems for indicators that the vulnerability may already have been exploited. Versa Technical Support is available to assist with patching, hardening, or remediation.

Apply hardening best practices

Customers should ensure that they have followed recommended best practices for security hardening of Versa Director. Customers can access detailed system hardening and firewall rules guidelines here:

  • Firewall Guidelines: Firewall Requirements (since 2015): This document details the necessary ports and protocols that need to be opened on the appropriate interfaces.
  • System Hardening (since 2017): This document provides comprehensive steps for implementing the hardening process for all components of the Versa solution.

Upgrade Director to one of the remediated versions

Versa recommends that the Director software be upgraded as soon as possible to one of the remediated software versions (see Resources below).

Check to see if the vulnerability has already been exploited

To identify if the vulnerability has already been exploited, customers can inspect the /var/versa/vnms/web/custom_logo/ folder for any suspicious files having been uploaded. Running the command: file -b –mime-type <.png file> should report the file type as “image/png”.

If you are a Versa customer who needs assistance with patching, system hardening, or remediation, please contact Versa Technical Support.

Useful resources

Customers can access one of the patched/remediated versions of Versa Director from the following software download links:

For additional information, please refer to the following resources:

Security bulletin advising hardening

Versa has sent out a security bulletin titled Security Bulletin: Advising The Review of Firewall Requirements for Versa Components to customers and partners on Friday, July 26, 2024. (Versa customer access only)

Security bulletin advising vulnerability

Versa has notified customers and partners about the vulnerability in Security Bulletin: Advising Zero-Day Vulnerability In Versa Director that was sent out on Friday, August 9, 2024. (Versa customer access only)

CISA known exploited vulnerability catalog

This CVE information is publicly available from CISA (Cybersecurity and Infrastructure Security Agency, part of the U.S. Department of Homeland Security), which curates a list of CVEs called the Known Exploited Vulnerabilities (KEV) catalog at CVE-2024-39717 – Versa Director Dangerous File Type Upload Vulnerability.

Versa security portal

Versa has updated the PSIRT section of the Versa Security Portal with CVE-2024-39717 to ensure that customers have one place to go for information and our most current information and remediation guidance. (Versa customer access only)

Versa System Hardening Guidelines

(available since 2017): This document provides comprehensive steps for implementing the hardening process for all components of the Versa solution.

Versa Firewall Requirements

Firewall Requirements (available since 2015): This document details the necessary ports and protocols that need to be opened on the appropriate interfaces.

The bottom line: Versa is actively reaching out and working with our customers and partners to ensure their safety by applying patches and hardening their attack surfaces per guidelines.

Versa Security Research Team

By Versa Security Research Team

Threat Research & Protection Team

The Versa Security Research Team identifies and analyzes threats targeting enterprise networks. They develop the detection rules, intrusion-prevention signatures, and security package updates built into the VersaONE platform, and publish advisories on active campaigns, from ransomware to zero-day vulnerabilities.

Research Lab

FAQs

CVE-2024-39717 is a high-severity vulnerability in Versa Director that enables privilege escalation through dangerous file type uploads. Users with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges can potentially upload malicious files. The vulnerability affects Versa SD-WAN customers running unpatched Versa Director versions 21.2.2 through 22.1.3 who have not applied system hardening and firewall guidelines.

Unlike many vulnerabilities exploited through automated scanning, CVE-2024-39717 requires elevated administrative privileges and an exposed management port, making it difficult to exploit. However, at least one Advanced Persistent Threat actor successfully leveraged it against managed service providers that had not implemented Versa's published firewall requirements and system hardening guidelines, which have been available since 2015 and 2017 respectively.

Organizations can check for exploitation by inspecting the /var/versa/vnms/web/custom_logo/ directory for suspicious uploaded files. Running the command file -b --mime-type against any .png file in that folder should return "image/png" as the file type. Any file reporting a different MIME type indicates potential compromise and warrants immediate investigation and engagement with Versa Technical Support.

Applying system hardening directly eliminates the initial access vector that threat actors used to exploit CVE-2024-39717. Impacted customers had left management ports exposed on the internet by not following Versa's published firewall requirements and hardening guidelines. Proper hardening restricts interface exposure, enforces port and protocol controls, and reduces the overall attack surface across all Versa solution components.

Enterprises should take three immediate actions: apply Versa's published system hardening and firewall best practices to restrict management port exposure, upgrade Versa Director to a remediated software version such as 21.2.3, 22.1.2, or 22.1.3 with the June 2024 hot fix or later, and inspect systems for indicators of prior exploitation. Versa Technical Support can assist throughout remediation.

Subscribe to the Versa Blog

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Related Posts

Company Updates Jan 30, 2026

'Secure by Design' at Versa: One Year of Progress

This blog walks through the seven CISA “Secure by Design” pledge goals and explains related and recent new capabilities and enhancements Versa has delivered, along with a quick summation of the importance of the changes.

Read More
Security Jul 01, 2026

MITRE ATT&CK vs. MITRE ATLAS: Two Frameworks, One Expanding Threat Landscape

As adversaries adopt AI-enabled attack techniques, traditional frameworks like MITRE ATT&CK no longer cover the full threat picture.

Read More

Versa System Hardening Guide

Step-by-step guidance for hardening every component of the Versa solution, including Versa Director, to restrict management port exposure and reduce the attack surface.

Read More