Chinese State Hackers Breach Telecom SD-WAN Management Systems via Versa Zero-Day

State-sponsored cyber espionage operators linked to China have compromised core networking infrastructure across global telecommunications providers and internet service providers by exploiting a zero-day flaw in Versa Networks' SD-WAN management software. The campaign deployed a memory-only Java webshell dubbed VersaMem directly into the orchestrator runtime, allowing attackers to harvest plaintext administrative credentials and gain deep visibility into downstream customer networks without leaving standard disk artifacts.

Federal cybersecurity authorities added the underlying vulnerability, cataloged as CVE-2024-39717, to the Known Exploited Vulnerabilities Catalog after forensic investigators identified active exploitation in the wild. While initial industry alerts mischaracterized the vulnerability as an unauthenticated attack, confirmed technical disclosures establish that exploitation requires high-tier administrative credentials. Attackers leveraged compromised credentials to reach exposed management interfaces and weaponized an unrestricted file upload flaw within the appliance's user interface.

[[image:poster]]

Vulnerability Root Cause and Exploitation Flow

The vulnerability resides within the Versa Network Management System (VNMS) graphical interface, specifically inside the administrative "Change Favicon" customization module. The endpoint failed to execute server-side MIME type or magic-byte verification on incoming files, relying solely on client-side filename extensions.

An attacker possessing Provider-Data-Center-Admin privileges could transmit a malicious Java Archive (.jar) file appended with an image extension such as .png. The application backend accepted the payload and wrote the binary directly into the web-accessible directory structure:

/var/versa/vnms/web/custom_logo/

Once written to storage, the embedded Apache Tomcat servlet container dynamically resolved and executed the Java bytecode, initiating the in-memory execution pipeline.

sequenceDiagram
 autonumber
 actor Attacker as Threat Actor (Volt Typhoon)
 participant Edge as Edge Perimeter / Ingress WAN
 participant GUI as Versa Director (Port 4566 / 9182)
 participant Disk as Local Path (/custom_logo/)
 participant Tomcat as Apache Tomcat Servlet Engine
 participant JVM as JVM Runtime / Memory Space

 Attacker->>Edge: Authenticate via Stolen Provider Admin Credentials
 Edge->>GUI: Ingress HTTP POST to Change Favicon Endpoint
 GUI->>Disk: Write Disguised JAR Payload (.png extension)
 Tomcat->>Disk: Dynamic Classloader Reads File
 Tomcat->>JVM: Execute Bytecode & Inject VersaMem Hook
 JVM->>Tomcat: Intercept ApplicationFilterChain.doFilter()
 Note over JVM,Tomcat: In-Memory Plaintext Credential Harvesting Active

VersaMem Memory Forensics and Interception Mechanics

VersaMem operates strictly in volatile JVM memory to bypass disk-based File Integrity Monitoring (FIM). Instead of registering new servlets in configuration files like web.xml, the malware manipulates active Java bytecode directly inside the Java Virtual Machine (JVM).

Using the Javassist bytecode manipulation library, VersaMem intercepts the request processing pipeline by hooking ApplicationFilterChain.doFilter() within Tomcat's Catalina engine.

B
Catalina StandardContext Pipeline
D
Inspect Request Parameters & Headers
(Staged In-Memory Plaintext Credential Store)
Reflective Bytecode Execution via defineClass
In-Memory Task Execution
Pass-Through to Legitimate Application Flow
Inbound HTTP / HTTPS Request] --> B[Tomcat Connector Engine

This hooking mechanism enables two critical capabilities:

• Credential Harvesting: VersaMem evaluates incoming HttpServletRequest objects targeting authentication paths, notably /vnms/login. It extracts raw username and password parameters before the application encrypts or hashes them, storing the credentials in an internal memory buffer.
• Reflective Bytecode Execution: The webshell listens for distinct HTTP headers containing base64-encoded Java class definitions. Using ClassLoader.defineClass(), it dynamically instantiates and executes secondary payloads entirely within JVM heap space, avoiding secondary file creation on the underlying Linux filesystem.

Forensic Detection Playbook and SRE Inspection Commands

Incident response teams managing Versa appliances must conduct multi-layer inspections across the local filesystem, active Java runtime memory, and authentication logs:

# 1. Inspect Custom Logo Directory for Non-Image Binaries
file -b --mime-type /var/versa/vnms/web/custom_logo/*

# Alert on output containing: application/zip, application/java-archive, or text/plain
# Expected baseline: image/png or image/jpeg

# 2. Extract Classloader Statistics and Detect Dynamic Bytecode Engines
TOMCAT_PID=$(pgrep -f "org.apache.catalina.startup.Bootstrap" || pgrep -f "vnms")
jcmd ${TOMCAT_PID} VM.classloader_stats
jcmd ${TOMCAT_PID} GC.class_histogram | grep -E "javassist|VersaMem|custom_logo"

# 3. Capture Thread Dumps and Live Memory Heap for Analysis
jstack -l ${TOMCAT_PID} > /tmp/tomcat_thread_dump.log
jmap -dump:live,format=b,file=/tmp/tomcat_heap_dump.hprof ${TOMCAT_PID}

# 4. Search Access Logs for Weaponized Favicon Calls
grep -En "POST.*/(changeFavicon|custom_logo)" /var/versa/vnms/logs/localhost_access_log*

# 5. Audit Provider-Level Administrative Logins
grep -i "login" /var/versa/vnms/logs/vnms-audit.log | grep -E "Provider-Data-Center-Admin|Provider-Data-Center-System-Admin"

Step-by-Step Port Isolation and Firewall Lockdown

Exploitation was facilitated by architectural misconfigurations in multi-tenant environments where management nodes were exposed to untrusted WANs rather than isolated Out-of-Band Management (OOBM) networks.

• Exposed High Availability Ports: Unfiltered access to TCP 4566 (Cisco NCS / Tail-f sync) and TCP 4570 (active-standby cluster messaging) exposed low-level coordination protocols directly to WAN interfaces.
• Exposed Management Interfaces: Web interfaces on ports 9182, 9183, and 443 permitted direct ingress connections from untrusted endpoints.

Enforce host-level packet filtering across all Director nodes to restrict these channels:

# Flush Existing VNMSHA Chain Rules
iptables -F VNMSHA 2>/dev/null || iptables -N VNMSHA

# Restrict HA Ports Exclusively to Explicit Peer Director Node IP
iptables -A INPUT -p tcp -s <PEER_DIRECTOR_IP> -m multiport --dports 4566,4570 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 4566,4570 -j DROP

# Restrict PostgreSQL Replication to Peer Director Node
iptables -A INPUT -p tcp -s <PEER_DIRECTOR_IP> --dport 5432 -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j DROP

# Restrict Web Management Access to Authorized Bastion CIDR
iptables -A INPUT -p tcp -s <TRUSTED_MGMT_SUBNET_CIDR> -m multiport --dports 9182,9183,443 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 9182,9183,443 -j DROP

# Persist Firewall Rules Across System Restarts
iptables-save > /etc/iptables/rules.v4

Affected Versions, Patch Validation, and Tenant Blast Radius

Organizations must verify installed software baselines and execute mandatory runtime restarts to clear active in-memory hooks:

# Verify Operating Version
versa-version

# Mandatory Daemon and JVM Restart to Terminate Memory Hooks
systemctl restart versa-director

# Confirm New Process Lifetime and PID
ps -eo pid,lstart,cmd | grep -i catalina

Downstream Blast Radius: A compromise at the Provider-Data-Center-Admin level collapses tenant isolation. Attackers gain access to IPsec Pre-Shared Keys (PSKs), cryptographic private keys, routing tables, and Zero-Touch Provisioning (ZTP) templates. Service providers must force tenant-wide credential rotations, re-key all SD-WAN IPsec mesh overlays, and audit live branch device configurations against baseline backups.

Long-Term SD-WAN Management Plane Hardening

Securing edge orchestration fabrics requires strict decoupling of control, management, and synchronization planes under Zero Trust Network Architecture (ZTNA) principles:

• Eliminate Public Management Exposure: Director nodes must reside strictly inside isolated management Virtual Routing and Forwarding (VRF) instances, accessible solely via bastion hosts enforcing FIDO2 hardware authentication.
• Microsegment Cluster Interconnects: Inter-node synchronization across TCP 4566, 4570, and 5432 must be restricted to isolated, point-to-point /30 subnets.
• Runtime Integrity Enforcement: Deploy Linux extended Berkeley Packet Filters (eBPF) to monitor JVM file descriptors and enforce read-only mount permissions across web server root directories.