In CISA KEV9.2 CriticalCWE-288
CVE-2025-34026
Versa Concerto Improper Authentication Vulnerability
VersaConcerto
Status
- Exploited in the wild
- In CISA KEV since 22 Jan
- Vendor fix available
Federal deadlineThu 12 Feb, 23:59 UTC
Passed 254 days ago
CISA KEV · added 22 Jan
Exploit probabilityEPSSchecked 25 Oct
82%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.2Critical
Description NVD
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 23 Jan · 10:16 UTC | SecurityOnline | CISA Adds 4 Critical Flaws to “Must-Patch” List as Exploits Surge |
| Fri 23 Jan · 12:26 UTC | Security Affairs | U.S. CISA adds Prettier eslint-config-prettier, Vite Vitejs, Versa Concerto SD-WAN orchestration platform, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog |
| Fri 23 Jan · 15:51 UTC | The Hacker News | CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities |
- CISA Updates KEV Catalog with Four Actively Exploited Software VulnerabilitiesThe Hacker News · mentions it in passing
- U.S. CISA adds Prettier eslint-config-prettier, Vite Vitejs, Versa Concerto SD-WAN orchestration platform, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- CISA Adds 4 Critical Flaws to “Must-Patch” List as Exploits SurgeSecurityOnline · first in our coverage