{"id":"CVE-2025-34027","published":"2025-05-21T21:58:31Z","modified":"2026-02-26T18:27:59Z","title":"Versa Concerto Authentication Bypass File Write Remote Code Execution","vendor":"Versa","product":"Concerto","tier":"core","eol":null,"affectedVersions":[{"vendor":"Versa","product":"Concerto","versions":[">= 12.1.2, <= 12.2.0"]}],"description":{"text":"The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Traefik reverse proxy configuration of Versa Concerto, the SD-WAN orchestration platform, allows an authentication bypass that grants access to administrative endpoints, and a race condition (TOCTOU) in the Spack upload endpoint can be combined with that access to manipulate path loading. An attacker with only network access to the platform, requiring no credentials or user interaction, can achieve remote code execution by winning the race between the file check and the write.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:47Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.46402,"percentile":0.98818,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-21","exploitedFirstSeen":"2025-07-21","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-21&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-22&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-23&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-24&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-25&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-26&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-27&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-28&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-29&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-30&host_type=src&vulnerability=cve-2025-34027","date":"2025-07-30"}],"evidenceTotal":206,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"references":[{"url":"https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce","tags":["exploit","mitigation"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-16088","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16088","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-34027","name":"Versa Concerto API Path Based - Authentication Bypass","severity":"critical","path":"http/cves/2025/CVE-2025-34027.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34027.yaml"}],"provenance":"source"},"exploitRefs":["https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"],"flow":[],"timeline":[{"date":"2025-05-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-34027","provenance":"source"},{"date":"2025-07-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-21&host_type=src&vulnerability=cve-2025-34027","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 467 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.76,"detail":"percentile 0.9882"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}