Versa fixes Director zero-day vulnerability exploited in attacks

Versa Networks patched a high-severity zero-day (CVE-2024-39717) in Versa Director that allowed users with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to upload malicious files disguised as PNGs via the 'Change Favicon' feature; the flaw was exploited in the wild by an APT actor at least once. Versa and CISA urge customers to implement long-standing system hardening and firewall guidance, upgrade impacted Director installations, and inspect /var/versa/vnms/web/custom_logo/ for suspicious uploads.