---
title: Versa VOS: one oversized Remote ID in an IKE Auth packet crashes vsmd on internet-facing Controllers, Hub Controllers and SSE Gateways (CVE-2026-107245) | ctxsec
url: https://ctxsec.com/items/versa-vos-ike-auth-remote-id-overflow-vsmd-dos-cve-2026-107245
description: "Versa says a stack buffer overflow in the IPsec stack of VOS (FlexVNF) lets an unauthenticated attacker crash the vsmd process, taking down the appliance's services, by sending an IKE Auth packet whose Remote ID is larger than the buffer after IKE SA negotiation fails. Exposed are nodes that terminate controller-staging-sdwan or remote-access-server IPsec profiles on a WAN interface, which Versa says typically covers all Controllers, Hub Controllers and SSE Gateways, plus site-to-site profiles with no peer IP, hostname or FQDN. Nodes not reachable from the internet aren't affected. Fixes are 23.1.2 and the July 2 (22.1.x) and Aug 3 (23.1.2) 2026 hotfixes."
status: "official (CVE-2026-107245 record, published Nov 10, 2026 00:32 UTC, with Versa's advisory text; Versa bulletin is behind its customer portal); no CVSS yet; the advisory's workaround mentions blocking source IPs of exploitation attempts but does not describe the scale of any activity"
published: 2026-11-09
---

> Versa says a stack buffer overflow in the IPsec stack of VOS (FlexVNF) lets an unauthenticated attacker crash the vsmd process, taking down the appliance's services, by sending an IKE Auth packet whose Remote ID is larger than the buffer after IKE SA negotiation fails. Exposed are nodes that terminate controller-staging-sdwan or remote-access-server IPsec profiles on a WAN interface, which Versa says typically covers all Controllers, Hub Controllers and SSE Gateways, plus site-to-site profiles with no peer IP, hostname or FQDN. Nodes not reachable from the internet aren't affected. Fixes are 23.1.2 and the July 2 (22.1.x) and Aug 3 (23.1.2) 2026 hotfixes.

[← Cybersecurity News](/news) · [markdown](/items/versa-vos-ike-auth-remote-id-overflow-vsmd-dos-cve-2026-107245.md)

official (CVE-2026-107245 record, published Nov 10, 2026 00:32 UTC, with Versa's advisory text; Versa bulletin is behind its customer portal); no CVSS yet; the advisory's workaround mentions blocking source IPs of exploitation attempts but does not describe the scale of any activity

2026-11-09

### Versa VOS: one oversized Remote ID in an IKE Auth packet crashes vsmd on internet-facing Controllers, Hub Controllers and SSE Gateways (CVE-2026-107245)

- **Workarounds from the advisory:** disable the staging VPN profile on Controllers and Hub Controllers except while bootstrapping devices with internet ZTP; set a remote peer IP, hostname or FQDN on every site-to-site profile; blackhole source IPs seen sending the malicious packets.
- **Affected trains:** 21.1.1 to 21.2.3, 22.1.2 to 22.1.4 before the July 2, 2026 hotfix, and 23.1.2 before the Aug 3, 2026 hotfix.
- SD-WAN controllers are high-value edge devices; even a crash-only bug can cut off every branch that depends on them.

Sources: [CVE-2026-107245 record (CVE.org): Versa VOS IPsec IKE Auth buffer overflow](https://www.cve.org/CVERecord?id=CVE-2026-107245) · [Versa Networks security bulletin (customer portal)](https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29)