CVE-2025-23170

Versa Director SD-WAN is vulnerable to command injection, allowing arbitrary command execution.

• CVSS 6.7
• CWE-77
• Input Validation and Sanitization
• Remote

The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.

CVE

CVE-2025-23170

CWE

CWE-77

CVSS base score

6.7

Published

2025-06-19

OWASP

A03:2021-Injection

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python

Solution

Upgrade Versa Director to a remediated software version.

import subprocess
import sys

def shell_connect(user, host):
    """
    Connects to a remote host via SSH using Shell-In-A-Box.
    """
    command = f"ssh -o StrictHostKeyChecking=no {user}@{host}"
    print(f"Executing command: {command}")
    try:
        subprocess.run(command, shell=True, check=True)
    except subprocess.CalledProcessError as e:
        print(f"Error executing command: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python shell_connect.py <user> <host>")
        sys.exit(1)

    user = sys.argv[1]
    host = sys.argv[2]

    shell_connect(user, host)

import subprocess
import shlex

def connect_to_host(user, host):
  """Connects to a host via SSH using subprocess.  Escapes the user input."""

  # Sanitize user input using shlex.quote to prevent command injection
  safe_user = shlex.quote(user)

  command = f"ssh {safe_user}@{host}"
  print(f"Executing: {command}")  #For debugging purposes.  Remove in prod
  try:
    subprocess.run(command, shell=True, check=True) #shell=False can be more secure, but need to pass command as a list
  except subprocess.CalledProcessError as e:
    print(f"Error: {e}")
    return False
  return True

# Example usage:
if __name__ == '__main__':
  user_input = input("Enter username: ") #Do not trust this input in real scenario.
  host_input = "192.168.1.100" #Hardcoded host for testing

  if connect_to_host(user_input, host_input):
    print("Connection successful.")
  else:
    print("Connection failed.")

; id;

@misc{vaitp:cve202523170,
  title        = {{Versa Director SD-WAN is vulnerable to command injection, allowing arbitrary command execution.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-23170},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-23170/}}
}