Critical Versa Concerto Flaws Let Attackers Escape Docker and Compromise Hosts
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-45410 | Traefik is a golang, Cloud Native Application Proxy. Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. NVD description · AI analysis pending | 7.5 | 2% |
| — | ||
| CVE-2025-34027 +1 in the same advisory: …34025 | Unauthenticated RCE in Versa Concerto via Auth Bypass and TOCTOU Race Versa Concerto, Versa Networks' SD-WAN orchestration platform, mishandles authentication in its Traefik reverse proxy configuration, allowing unauthenticated attackers to reach administrative endpoints. By chaining this bypass with the Spack upload endpoint, an attacker can trigger a time-of-check to time-of-use (TOCTOU) file write combined with a race condition to manipulate path loading and achieve remote code execution without any credentials. Successful exploitation gives the attacker code execution on the Concerto server, with related coverage warning the flaws could let attackers escape the Docker container and compromise the underlying host (CVSS 4.0 score 10.0, critical). Concerto versions 12.1.2 through 12.2.0 are known to be affected, and additional versions may also be vulnerable, so any internet-exposed or broadly reachable Concerto deployment is at risk. A public proof-of-concept walkthrough has been published, the flaw sits in the 99th EPSS percentile with a 45.2% probability of exploitation within 30 days, and it is not yet on CISA's KEV list. Do: Upgrade Concerto to a release beyond 12.2.0 as directed by Versa's advisory, since additional versions may also be affected. Until patched, restrict access to Concerto's portal/administrative endpoints and the Spack upload endpoint to trusted management networks only, and review access logs for unauthenticated requests to administrative endpoints. Because exploitation involves a timing-based race, network-level access restriction is the most reliable interim mitigation. | 10.0 group max | 45% | PoC |
| nichelikely hundreds to low thousands of deployed instances, of which an unknown subset is internet-exposed | |
| CVE-2025-34026 | Authentication Bypass in Versa Concerto SD-WAN Orchestration Platform (CVE-2025-34026) Versa Concerto, Versa Networks' SD-WAN orchestration and management platform, contains an authentication-bypass flaw (CWE-288) in its Traefik reverse proxy configuration that allows unauthenticated remote attackers to reach administrative endpoints that should require login. The flaw is network-reachable with no privileges or user interaction required, and the internal Actuator endpoint is also reachable, letting attackers pull heap dumps and trace logs that may contain sensitive information. Public research (Project Discovery) demonstrates the bypass can be chained toward remote code execution, and separate Versa Concerto flaws reported publicly have been shown to allow Docker escapes and compromise of the underlying host. Known-affected versions are Concerto 12.1.2 through 12.2.0, with additional versions possibly vulnerable, so any organization running a vulnerable Concerto instance — particularly one exposed to the internet — is at risk. The flaw is confirmed to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22, and EPSS assigns an ~82% probability of exploitation within 30 days (100th percentile). Do: Upgrade Concerto to the fixed release per Versa Networks' security advisory — the known-affected range is 12.1.2 through 12.2.0, but because additional versions may be vulnerable, confirm the patched version with the vendor; U.S. federal agencies must apply these mitigations or discontinue use of the product under BOD 22-01. In the meantime, restrict internet exposure of Concerto portals and its administrative/Actuator endpoints, and review trace logs and any evidence of heap-dump access for signs of unauthenticated administrative requests. | 9.2 | 82% | KEV PoC |
| moderatelikely hundreds to low thousands of vulnerable Concerto deployments, with an unknown but smaller subset exposed to the internet |
Full article656 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 22, 2025Vulnerability / Software Security
Cybersecurity researchers have uncovered multiple critical security vulnerabilities impacting the Versa Concerto network security and SD-WAN orchestration platform that could be exploited to take control of susceptible instances.
It's worth noting that the identified shortcomings remain unpatched despite responsible disclosure on February 13, 2025, prompting a public release of the issues following the end of the 90-day deadline.
"These vulnerabilities, when chained together, could allow an attacker to fully compromise both the application and the underlying host system," ProjectDiscovery researchers Harsh Jaiswal, Rahul Maini, and Parth Malhotra said in a report shared with The Hacker News.
The security defects are listed below -
- CVE-2025-34025 (CVSS score: 8.6) - A privilege escalation and Docker container escape vulnerability that's caused by unsafe default mounting of host binary paths and could be exploited to gain code execution on the underlying host machine
- CVE-2025-34026 (CVSS score: 9.2) - An authentication bypass vulnerability in the Traefik reverse proxy configuration that allows an attacker to access administrative endpoints, which could then be exploited to access heap dumps and trace logs by exploiting an internal Spring Boot Actuator endpoint via CVE-2024-45410
- CVE-2025-34027 (CVSS score: 10.0) - An authentication bypass vulnerability in the Traefik reverse proxy configuration that allows an attacker to access administrative endpoints, which could then be exploited to achieve remote code execution by exploiting an endpoint related to package uploads ("/portalapi/v1/package/spack/upload") via arbitrary file writes
Successful exploitation of CVE-2025-34027 could allow an attacker to leverage a race condition and write malicious files to disk, ultimately resulting in remote code execution using LD_PRELOAD and a reverse shell.
"Our approach involved overwriting ../../../../../../etc/ld.so.preload with a path pointing to /tmp/hook.so," the researchers said. "Simultaneously, we uploaded /tmp/hook.so, which contained a compiled C binary for a reverse shell. Since our request triggered two file write operations, we leveraged this to ensure that both files were written within the same request."
"Once these files were successfully written, any command execution on the system while both persisted would result in the execution of /tmp/hook.so, thereby giving us a reverse shell."
In the absence of an official fix, users are advised to block semicolons in URL paths and drop requests where the Connection header contains the value X-Real-Ip. It's also recommended to monitor network traffic and logs for any suspicious activity.
Update
Versa Networks, in a statement shared with The Hacker News, said the issues were addressed in Concerto version 12.2.1 GA released on April 16, 2025. The complete response from the company is below -
Versa is committed to maintaining the highest standards of security and transparency across our platform.
On February 13, 2025, three vulnerabilities were identified and confirmed in our Concerto software platform. As part of our standard security response process, we developed and validated fixes, which were completed on March 7, 2025, and the hotfix made available to customers. A Generally Available (GA) software release containing these remediations was made available to all customers on April 16, 2025.
Many customers have already upgraded to the April 16th release, though we recognize some deployments may still be pending. Detailed information on affected releases and mitigation steps has been posted for customer access only.
There is no indication that these vulnerabilities were exploited in the wild, and no customer impact has been reported. All affected customers were notified through established security and support channels with guidance on how to apply the recommended updates.
Versa follows responsible disclosure practices and takes a proactive approach to identifying, mitigating, and communicating potential risks. Security is foundational to our platform, and we continue to invest in continuous monitoring, rapid response, and customer education as part of our commitment to trust and protection.
(The story was updated after publication to include a response from Versa Networks about the patch information.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/unpatched-versa-concerto-flaws-let.html