Parth Malhotra

The Versa Concerto SD-WAN orchestration platform contains a flaw related to improper permission assignment for a critical resource during certificate signing request validation. This can lead to privilege escalation and container escape. The unsafe default mounting of host binary paths allows a container to modify host paths. Successful exploitation of this issue may allow an attacker to execute arbitrary code or gain direct access to the host, depending on the host operating system configuration.

The Versa Concerto SD-WAN orchestration platform has a flaw in the Traefik reverse proxy configuration that allows an attacker to bypass authentication and access administrative endpoints. The internal Actuator endpoint can be exploited to gain access to heap dumps and trace logs. This issue is actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Attackers can extract credentials and tokens from heap dumps, access internal SD-WAN management endpoints, perform lateral movement to managed edge devices, and potentially deploy persistent backdoors. The root cause is a misconfigured Traefik reverse proxy that forwards unauthenticated requests to `/actuator/*` endpoints. The `/actuator/*` endpoints expose sensitive memory and administrative functions.

The Versa Concerto SD-WAN orchestration platform contains a flaw in the Traefik reverse proxy configuration that allows an attacker to bypass authentication and access administrative endpoints. The Spack upload endpoint can be exploited using a Time-of-Check to Time-of-Use (TOCTOU) write condition combined with a race condition to achieve remote code execution (RCE) through path loading manipulation. This allows an unauthenticated actor to achieve RCE. The issue is actively exploited.