CVE-2024-45208: Versa Director SD-WAN RCE Vulnerability

CVE-2024-45208 Overview

CVE-2024-45208 is a critical improper access control vulnerability in the Versa Director SD-WAN orchestration platform. The vulnerability exists in the High Availability (HA) communication mechanism that utilizes Cisco NCS application services. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange HA information using a shared password. Affected versions of Versa Director bind these ports on all network interfaces rather than restricting them to internal HA communication channels.

An attacker with network access to the Versa Director could exploit this vulnerability by accessing the NCS service on port 4566, enabling unauthorized administrative actions and potential remote code execution on the affected system. This vulnerability poses a significant risk to organizations using Versa Director for SD-WAN orchestration, as it could allow complete compromise of the network management infrastructure.

Critical Impact

Successful exploitation enables unauthorized administrative access and remote code execution on Versa Director systems, potentially compromising the entire SD-WAN infrastructure managed by the platform.

Affected Products

• Versa Director (versions prior to 21.2.3)
• Versa Director (versions prior to 22.1.2)
• Versa Director (versions prior to 22.1.3 and 22.1.4)

Discovery Timeline

• June 19, 2025 - CVE-2024-45208 published to NVD
• June 23, 2025 - Last updated in NVD database

Technical Details for CVE-2024-45208

Vulnerability Analysis

The vulnerability stems from improper access control (CWE-284) in the Versa Director's High Availability architecture. The platform leverages Cisco NCS application services for HA functionality, with Active and Standby Director nodes exchanging state information over dedicated TCP ports. The core security flaw is that these sensitive management ports are bound to all network interfaces (0.0.0.0) rather than being restricted to trusted internal interfaces used exclusively for HA communication.

This design weakness exposes critical administrative services to any network segment that can reach the Versa Director, dramatically expanding the attack surface. The NCS service running on port 4566 accepts connections authenticated via a shared password, and when accessible to attackers, can be leveraged to execute administrative commands with elevated privileges.

Versa Networks has stated they are not aware of any reported instances where this vulnerability was exploited in the wild. However, proof of concept code for this vulnerability has been disclosed by third-party security researchers, increasing the urgency for organizations to remediate.

Root Cause

The root cause of CVE-2024-45208 is improper network binding configuration in the Versa Director's HA communication services. The NCS service ports (4566 and 4570) are configured to listen on all available network interfaces by default, rather than being restricted to specific internal interfaces designated for Director-to-Director HA communication. This violates the principle of least privilege for network services and exposes sensitive administrative functionality to potentially untrusted networks.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability through the following attack pattern:

1. Network Reconnaissance - Attacker identifies Versa Director systems with exposed ports 4566 or 4570 accessible from their network position
2. Service Access - Attacker establishes a TCP connection to the exposed NCS service on port 4566
3. Exploitation - Using knowledge of the NCS protocol and available PoC techniques, the attacker interacts with the service to perform unauthorized administrative actions
4. Compromise - Successful exploitation grants the attacker the ability to execute arbitrary commands with elevated privileges on the Versa Director system

The vulnerability requires network access to the Versa Director management ports but does not require prior authentication, making it highly exploitable from any network segment with connectivity to the exposed ports.

Detection Methods for CVE-2024-45208

Indicators of Compromise

• Unexpected network connections to TCP ports 4566 or 4570 from IP addresses outside the expected HA peer relationship
• Authentication attempts or successful authentications to the NCS service from non-Director systems
• Unusual administrative actions or configuration changes logged on Versa Director that cannot be attributed to legitimate administrators
• New or unexpected processes spawned by the NCS service or related Versa Director components

Detection Strategies

• Monitor network traffic to ports 4566 and 4570 for connections originating from IP addresses other than legitimate HA peer Directors
• Deploy network intrusion detection signatures to identify NCS protocol traffic from unexpected sources
• Review Versa Director audit logs for administrative actions that do not correlate with authorized change windows or personnel
• Implement SentinelOne endpoint protection on Versa Director hosts to detect suspicious process execution and lateral movement attempts

Monitoring Recommendations

• Configure network monitoring to alert on any external connections to Versa Director HA ports (4566, 4570)
• Enable comprehensive logging on Versa Director systems and forward logs to a SIEM for correlation and analysis
• Establish baseline network communication patterns for Director HA traffic and alert on deviations
• Regularly audit firewall rules to ensure HA ports are not inadvertently exposed to untrusted networks

How to Mitigate CVE-2024-45208

Immediate Actions Required

• Review firewall rules to ensure TCP ports 4566 and 4570 are only accessible from legitimate HA peer Director IP addresses
• Follow the Versa Networks Hardening Guide to restrict port binding
• Audit network segmentation to verify Versa Director management interfaces are isolated from untrusted networks
• Apply available patches by upgrading to Versa Director versions 21.2.3, 22.1.2, 22.1.3, or 22.1.4

Patch Information

Versa Networks has released patched versions of Versa Director that address this vulnerability. Organizations should upgrade to one of the following versions:

• Versa Director Release 21.2.3
• Versa Director Release 22.1.2
• Versa Director Release 22.1.3
• Versa Director Release 22.1.4

Additional information is available in the Versa Networks Exploit Discovery Advisory and the Versa Networks Email Bulletin.

Workarounds

• Implement network-level access controls (firewall rules, ACLs) to restrict access to ports 4566 and 4570 exclusively to authorized HA peer systems
• If direct patching is not immediately possible, isolate Versa Director systems on a dedicated management VLAN with strict ingress filtering
• Configure host-based firewalls on Versa Director systems to deny connections to HA ports from all sources except the designated peer Director IP address
• Consider temporarily disabling HA functionality if the standby Director is not operationally critical while remediation is planned

# Example iptables rules to restrict HA port access (adjust IP addresses as needed)
# Allow HA traffic only from peer Director IP
iptables -A INPUT -p tcp --dport 4566 -s <PEER_DIRECTOR_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 4570 -s <PEER_DIRECTOR_IP> -j ACCEPT
# Drop all other traffic to HA ports
iptables -A INPUT -p tcp --dport 4566 -j DROP
iptables -A INPUT -p tcp --dport 4570 -j DROP