Type Vulnerability
Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints.
Versa · Auth bypass
Versa Concerto Authentication Bypass Vulnerability
CVE-2025-34026
What this means
This is rated critical severity (9.2 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Versa Networks Concerto is in your estate, and treat that as the priority.
Full vendor description
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Scoring and exploitation
9.2/ 10
CVSS 4.0 base scoreCritical
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality and subsequent confidentiality; low on subsequent integrity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Attack requirementsNoneAT:N
Privileges requiredNonePR:N
User interactionNoneUI:N
Impact
Longer bar: more harm
ConfidentialityHighVC:H
IntegrityNoneVI:N
AvailabilityNoneVA:N
Subsequent confidentialityHighSC:H
Subsequent integrityLowSI:L
Subsequent availabilityNoneSA:N
- Elevated attack likelihood (~81.8% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Versa Concerto
Weaknesses
CWE-288
Affected products ()
- Versa Networks Concerto
Show the raw CPE strings (3)
- cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:*
- cpe:2.3:a:versa-networks:concerto:12.1.2:-:*:*:*:*:*:*
- cpe:2.3:a:versa-networks:concerto:12.2.0:*:*:*:*:*:*:*
References
4 links from the CVE record, grouped by site; the vendor's advisory comes first.
security-portal.versa-networks.com1 linkVendor advisory
- 6830f94328defa375486ff2e (opens in a new tab)Vendor Advisory
projectdiscovery.io1 link
- versa-concerto-authentication-bypass-rce (opens in a new tab)Exploit · Mitigation · Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource