Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2025-34026: Versa Concerto allows unauthorized admin access
CVE-2025-34026 · published 1 year ago · actively exploited
Summary
The Versa Concerto SD-WAN platform’s web gateway is misconfigured, letting anyone reach admin functions without proper login. Through these functions an attacker could view internal memory dumps and detailed logs, exposing sensitive information. Apply the vendor’s security update or reconfigure the gateway to require proper authentication for all admin endpoints.
What to do
- Update versa-networks concerto to version 12.1.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| versa | concerto | All versions |
| versa-networks | concerto |
>= 11.4.0, < 12.1.2 12.1.2 12.2.0 cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:* |
Original advisory text
Versa Concerto Improper Authentication Vulnerability
Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.
References
- https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce Exploit Mitigation Third Party Advisory
- https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff... Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-... US Government Resource
Internet-facing
3 days
Internal
14 days
- Known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.2
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
82%
chance of attack within 30 days
Type
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published21 May 2025
Updated17 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta