High severity7.5CISA KEVNVD Advisory· Published May 21, 2025· Updated Jun 17, 2026
CVE-2025-34026
CVE-2025-34026
Description
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:*range: >=11.4.0,<12.1.2
- cpe:2.3:a:versa-networks:concerto:12.1.2:-:*:*:*:*:*:*
- cpe:2.3:a:versa-networks:concerto:12.2.0:*:*:*:*:*:*:*
- (no CPE)range: 12.1.2 - 12.2.0
- (no CPE)range: 12.1.2
Patches
Vulnerability mechanics
References
3- projectdiscovery.io/blog/versa-concerto-authentication-bypass-rcenvdExploitMitigationThird Party Advisory
- security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2envdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.