CVE-2025-34027

Versa Concerto, Versa Networks' SD-WAN orchestration platform, mishandles authentication in its Traefik reverse proxy configuration, allowing unauthenticated attackers to reach administrative endpoints. By chaining this bypass with the Spack upload endpoint, an attacker can trigger a time-of-check to time-of-use (TOCTOU) file write combined with a race condition to manipulate path loading and achieve remote code execution without any credentials. Successful exploitation gives the attacker code execution on the Concerto server, with related coverage warning the flaws could let attackers escape the Docker container and compromise the underlying host (CVSS 4.0 score 10.0, critical). Concerto versions 12.1.2 through 12.2.0 are known to be affected, and additional versions may also be vulnerable, so any internet-exposed or broadly reachable Concerto deployment is at risk. A public proof-of-concept walkthrough has been published, the flaw sits in the 99th EPSS percentile with a 45.2% probability of exploitation within 30 days, and it is not yet on CISA's KEV list.

What to do: Upgrade Concerto to a release beyond 12.2.0 as directed by Versa's advisory, since additional versions may also be affected. Until patched, restrict access to Concerto's portal/administrative endpoints and the Spack upload endpoint to trusted management networks only, and review access logs for unauthenticated requests to administrative endpoints. Because exploitation involves a timing-based race, network-level access restriction is the most reliable interim mitigation.