What’s Vulnerable › Vulnerabilities

CVE-2019-25029

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-26 · updated 2026-08-31
• Weakness: CWE-77

Description

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

Affected products

• Versa Director: before 16.1R2S11; from 20.2.0 before 20.2.2; from 21.1.0 before 21.1.1; from 21.2.0 before 21.2.1 — fixed in 16.1R2S11, 20.2.2, 21.1.1, 21.2.1

How to fix

Upgrade to a fixed version: Versa Director 16.1R2S11, 20.2.2, 21.1.1, 21.2.1. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/1168198
• https://hackerone.com/reports/1168198

Get alerted when CVE-2019-25029 or the next vulnerability affects your stack