External risk intelligence

VOS Node.js ZTP Session ID Predictability Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-107242

The vulnerability resides in a web service used for Zero Touch Provisioning (ZTP) on networking appliances. While intended to be disabled after provisioning, such services on edge appliances are often reachable via network interfaces and frequently present in deployment scenarios where appliances are integrated into broader network management or orchestration workflows, making public-facing or external exposure a common deployment characteristic.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a Node.js web service for Versa VOS appliances could allow attackers to predict session IDs, potentially hijacking user sessions. This service is used for initial device setup and is recommended to be disabled afterward. The main concern is confirming if this service remains active and exposed on your network.

Predictable session IDs can lead to unauthorized access.
It impacts device provisioning, a critical initial setup step.
Confirm if the service is active and exposed post-provisioning.

Attack Path

How an attacker could exploit the issue

An attacker could target a networking appliance's web service, initially exposed for automated setup. This service generates predictable session identifiers, allowing an attacker to guess a valid session ID and take over an active user's session.

Network access required.
Predictable session IDs trigger vulnerability.
Session hijacking is the primary risk.

Live Threat

Current exploitation, exposure, and threat context

The Node.js web service, used for URL-based Zero Touch Provisioning (ZTP) on VOS appliances, generates predictable session identifiers. When this service is active and accessible, an attacker could potentially predict a user's session ID and hijack their session. This risk is mitigated when the Node.js web service is disabled, as recommended after the initial provisioning is complete.

Session IDs for ZTP.
Predictable IDs due to flawed generation.
Session hijacking.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Node.js web service on VOS appliances presents a risk if not disabled post-provisioning. Infrastructure or network teams responsible for VOS deployments should first verify which appliances have this service enabled, assess their network exposure, and confirm if they are business-critical. Ownership should then be assigned to the accountable team for remediation planning.

Infrastructure or network team ownership.
Confirm Node.js service status and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the VOS appliance software?

VOS, formerly known as Versa FlexVNF, is a software platform used for networking and security, such as SD-WAN. It includes a specialized Node.js web service that handles Zero Touch Provisioning (ZTP), a process designed to automate the initial setup and configuration of the device when it is first deployed into a network.

What does CWE-340 mean for CVE-2026-107242?

CWE-340 refers to the generation of predictable identifiers. In this case, the Node.js service uses a method (UUIDv1) that relies on predictable inputs like the system time and MAC address. Because these values are often guessable or stable, the resulting session IDs follow a pattern, allowing an attacker to mathematically anticipate what the next valid session ID will be to gain unauthorized access.

How does an attacker trigger this vulnerability?

An attacker triggers the vulnerability by observing or guessing the predictable session IDs generated by the ZTP service while it is active. The issue does not exist if the Node.js web service has been properly disabled after the initial provisioning process is finished, as the vulnerable entry point would no longer be reachable.

Why should I be concerned about CVE-2026-107242?

Halo Surface Signal indicates this vulnerability is likely to be relevant because ZTP services on networking appliances are often accessible via network interfaces. Even if the service is meant only for setup, these devices are frequently deployed in ways that leave them reachable from broader network segments, increasing the likelihood that an attacker could reach the service.

What should I do if I use VOS appliances?

Your first step is to audit your VOS deployments to identify which appliances still have the Node.js ZTP service enabled. Since this component is not required after the device is successfully provisioned, the recommended response is to disable the service according to your security hardening documentation to close the attack path.

References

security-portal.versa-networks.com/emailbulletins/6af22a90dd1c93ddc0a3e836

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.