Quantum Secular Labs / Blog / Advisories

CVE-2025-34026: Versa Concerto Improper Authentication Vulnerability

CVE-2025-34026 is rated critical with a CVSS v4.0 base score of 9.2 and affects Versa Concerto. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-01-22, which means exploitation in the wild has been observed.

Vulnerability description

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

Severity breakdown

CVSS v4.0 9.2: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Attack vector: Network. Exploitable remotely over the network.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Attack requirements: None. No deployment or execution conditions are needed.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Confidentiality impact (vulnerable system): High. Total loss of confidentiality.
  • Integrity impact (vulnerable system): None. No loss of integrity.
  • Availability impact (vulnerable system): None. No effect on availability.
  • Confidentiality impact (subsequent systems): High. Total loss of confidentiality on other systems.
  • Integrity impact (subsequent systems): Low. Some data on other systems can be modified.
  • Availability impact (subsequent systems): None. No availability impact beyond the vulnerable system.

Underlying weakness

CWE-288: Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Affected products

  • Versa Networks Concerto: from 11.4.0 before 12.1.2; 12.1.2; 12.2.0

References