Exploitation of Zero-Day Vulnerability in SDWAN

Security researchers have identified a zero-day vulnerability in the management servers of SDWAN provider Versa, which serves various ISPs and managed service providers. Attackers can exploit this vulnerability to intercept and harvest network access credentials from multiple customer environments, allowing unauthorized access to sensitive data. The research attributes this attack to Volt Typhoon, a group reportedly backed by the Chinese state, highlighting the ongoing threat posed by state-sponsored actors. Customers using managed services should inquire with their providers about remediation steps and ensure they are updated on security measures, as many may not have direct access to upgrade management software.