CVE-2025-34027

The vulnerability consists of two related stages. The first is an authentication bypass in the Traefik reverse proxy configuration, which allows the attacker to access administrative endpoints without any credentials. Subsequently, through the Spack file upload endpoint, the attacker can execute a Time-of-Check to Time-of-Use (TOCTOU, CWE-367) attack — the time window between file verification and its use is exploited in conjunction with a race condition to manipulate the module loading path. As a result, the attacker can cause arbitrary code execution on the server.

An unauthenticated remote attacker can achieve full code execution (RCE) on the SD-WAN orchestration platform, which in practice means complete takeover of the managed network infrastructure and potential threat to connected systems (high impact on system confidentiality and integrity as well as related systems).

Patches available from the vendor should be applied as soon as possible in accordance with references. The description does not indicate a specific patched version — it is recommended to contact Versa Networks and monitor the vendor's official security channels. Until the patch is deployed, it is recommended to restrict network access to the Concerto platform's administrative endpoints and verify Traefik configuration for access control.

Versa Concerto SD-WAN Orchestration Platform in versions 12.1.2 through 12.2.0 inclusive. The vendor indicates that additional versions may also be vulnerable.