CVE-2025-34027

Name of the Vulnerable Software and Affected Versions Versa Concerto versions 12.1.2 through 12.2.0

Description The Versa Concerto SD-WAN orchestration platform contains a flaw in the Traefik reverse proxy configuration that allows an attacker to bypass authentication and access administrative endpoints. The Spack upload endpoint can be exploited using a Time-of-Check to Time-of-Use (TOCTOU) write condition combined with a race condition to achieve remote code execution (RCE) through path loading manipulation. This allows an unauthenticated actor to achieve RCE. The issue is actively exploited.

Recommendations Versions 12.1.2 through 12.2.0 should be updated to a newer version that addresses this vulnerability.