“The advisory placed much of the blame on Versa customers who "failed to implement system hardening and firewall guidelines…leaving a management port exposed on the internet that provided the threat actors with initial access."”
Black Lotus Labs found a backdoor on Versa Director boxes at ISPs and MSPs, with the first exploit at a US ISP on June 12. Versa published its advisory on August 26, and its CVE listing still calls the third-party reports unconfirmed. Lumen spent nine weeks helping Versa and got no credit. The vendor shipped the zero-day and blamed the customers for the open port.