CVE-2024-39717

CVE Enrichment

CVSS: 7.2 HIGH
EPSS: 3.99%
EPSS Percentile: 90.46%
CISA KEV: YES — Known Exploited Vulnerability

Description

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 23-Aug-2024 02:15
Last Modified: 17-Jun-2026 14:42
EPSS Date: 2026-10-28
CWE: CWE-434

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:H /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2024-08-23
Remediation Due: 2024-09-13
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2024-39717

Affected Products / Versions

versa-networks / versa_director
Version / affected range: 21.2.2
cpe:2.3:a:versa-networks:versa_director:21.2.2:*:*:*:*:*:*:*
versa-networks / versa_director
Version / affected range: 21.2.3
cpe:2.3:a:versa-networks:versa_director:21.2.3:*:*:*:*:*:*:*
versa-networks / versa_director
Version / affected range: 22.1.1
cpe:2.3:a:versa-networks:versa_director:22.1.1:*:*:*:*:*:*:*
versa-networks / versa_director
Version / affected range: 22.1.2
cpe:2.3:a:versa-networks:versa_director:22.1.2:*:*:*:*:*:*:*
versa-networks / versa_director
Version / affected range: 22.1.3
cpe:2.3:a:versa-networks:versa_director:22.1.3:*:*:*:*:*:*:*

References

Last enrichment sync: 29-Oct-2026 03:46
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

actor was previously observed exploiting a file upload vulnerability in Versa Director as a zero-day (CVE-2024-39717) to deliver a bespoke web shell called VersaMem designed to harvest credentials and enable access to Black Lotus Labs Links Volt Typhoon to Silent Train Network Used in Zero-Day Campaigns
CVE-2024-39717 – Versa Director Volt Typhoon Uses ‘Silent Train’ Relay Framework in Zero-Day Attacks

CVE (4)

Malware (1)

Threat Actors (5)

MITRE ATT&CK (5)

Vendors (7)

Products (7)

Tools (2)

Industries (13)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.