VDB

CVE-2025-34026

CVE-2025-34026 PUBLISHED KEV CVSS 9.199999809265137 CRITICAL

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

EPSS 83.11% · 99.6th percentile

Risk Scores

CVSS 4.0
9.199999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS Score
83.11%
99.6th percentile

Affected Products

VendorProductVersions
versaconcerto12.1.2, 12.1.2
versa-networksconcerto12.1.2, 12.2.0, 11.4.0
VersaConcerto12.1.2, 12.1.2

Timeline

  • Jan 20, 1970 CrowdSec Sighting
  • Jan 20, 1970 CrowdSec Sighting
  • Jan 21, 1970 CrowdSec Sighting
  • Oct 21, 2021 CrowdSec Sighting
  • Dec 11, 2021 CrowdSec Sighting
  • Mar 18, 2022 CrowdSec Sighting
  • Nov 8, 2022 CrowdSec Sighting
  • Dec 26, 2022 CrowdSec Sighting
  • Mar 9, 2023 CrowdSec Sighting
  • Mar 26, 2023 CrowdSec Sighting
  • Apr 5, 2023 CrowdSec Sighting
  • Apr 26, 2023 CrowdSec Sighting

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›