CVE-2024-39717 Versa Director: dangerous file upload
In plain words: The program accepts files it should refuse, such as programs disguised as ordinary uploads. The attacker can place and run their own tools on the server.
Confirmed exploited by CISA on · US federal patch deadline Sep 13, 2024
What to do
- Install Versa's security update for Director. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Patch edge devices first — attackers often start scanning for them within hours of a fix.
- Never expose the device's admin page to the internet.
- After patching a device that was exposed, follow the vendor's compromise checks, end active sessions and change passwords.
Who is affected
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
What's at risk: They face the internet and guard the whole network, so a flaw here can hand attackers a way in — and these devices usually run no antivirus, so break-ins go unnoticed.
The details
- Official name
- Versa Director Dangerous File Type Upload Vulnerability
- Product
- Versa Director
- CISA description
- The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.
- Type of flaw
- Dangerous file upload (CWE-434)
- Confirmed exploited
- Aug 23, 2024
- US federal patch deadline
- Sep 13, 2024
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2024-39717 ·
Questions about CVE-2024-39717
Is CVE-2024-39717 being exploited?
Yes. CISA added CVE-2024-39717 to its Known Exploited Vulnerabilities catalog on Aug 23, 2024, which means there is reliable evidence of real-world attacks.
How do I fix CVE-2024-39717?
Install Versa's security update for Director. If no update exists, follow the vendor's workaround or stop using the product until one ships. Patch edge devices first — attackers often start scanning for them within hours of a fix.
Am I affected by CVE-2024-39717?
Only if you use Versa Director. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.