CVE-2025-34026

HIGHCISA KEV

7.5

Beschreibung

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht5/21/2025

Zuletzt geandert1/23/2026

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerVersa

ProduktConcerto

SchwachstellennameVersa Concerto Improper Authentication Vulnerability

KEV Aufnahmedatum2026-01-22

Behebungsfrist2026-02-12

Ransomware-NutzungUnknown

Betroffene Produkte

versa-networks:concerto

Schwachen (CWE)

CWE-288

Referenzen

https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce(disclosure@vulncheck.com)

https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.