Versa Director SD-WAN Two-Factor Authentication Vulnerability Allowing OTP Redirection and Reuse

A vulnerability in the Versa Director SD-WAN orchestration platform's Two-Factor Authentication (2FA) implementation allows for One-Time Passcodes (OTP) to be redirected and reused. The 2FA system, which relies on OTPs delivered via email or SMS, accepts untrusted user input when sending codes. This flaw enables an attacker with a valid username and password to intercept OTP delivery by redirecting it to their own device. Additionally, OTPs are not invalidated after use, allowing for reuse by an attacker who has previously intercepted a code. The 2FA system also lacks proper restrictions on the number and frequency of login attempts, and the OTP values are generated from a small keyspace, making brute-force attacks more feasible.

Impact

Exploitation of this vulnerability could lead to unauthorized access by allowing an attacker to intercept and reuse OTPs, bypassing the 2FA protection.

Remediation

Users are advised to upgrade to Versa Director version 22.1.4 (released February 8, 2025), 22.1.3 (available June 10, 2025), 22.1.2 (also available June 10, 2025), or 21.2.3 (available June 10, 2025).