CVE-2025-34027: Versa Concerto auth bypass and TOCTOU race leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 4.0 score of 10 with no authentication or user interaction required and public exploit references, allowing unauthenticated RCE on an SD-WAN orchestration platform.

What it is

Versa Concerto's Traefik reverse proxy configuration contains an authentication bypass that lets an unauthenticated attacker reach administrative endpoints. The Spack upload endpoint can then be abused via a TOCTOU write and race condition to manipulate path loading and achieve remote code execution. Concerto 12.1.2 through 12.2.0 is known affected, and the vendor notes additional versions may be vulnerable.

Impact

An unauthenticated attacker gains access to administrative functionality and can execute arbitrary code on the Concerto orchestration platform, compromising the SD-WAN management plane.

Attack surface

Reachable over the network through the Traefik reverse proxy with no authentication and no user interaction required, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The Spack upload endpoint is the specific path used to chain the bypass into code execution.

Exploitation

Not listed in CISA KEV, but EPSS is 0.4522 (98.7th percentile) and both references are tagged Exploit, indicating public exploit detail exists. No ransomware group usage is documented.

What to do

• Upgrade Concerto to a version later than 12.2.0 once Versa publishes a fixed release; confirm the fixed version with the vendor.
• Restrict network access to Concerto administrative and Spack upload endpoints to trusted management networks only.
• Review and harden the Traefik reverse proxy configuration so administrative routes are not exposed without authentication.
• Monitor for and block unexpected writes or path manipulation attempts against the Spack upload endpoint.
• If patching is delayed, isolate Concerto management interfaces behind an authenticated jump host or VPN.

Detection

• Alert on unauthenticated requests reaching Concerto administrative endpoints through Traefik.
• Monitor Spack upload endpoint activity for unusual file writes or rapid repeated requests suggesting a race condition.
• Watch for unexpected process execution or new files in application path directories on Concerto hosts.
• Correlate Traefik access logs with application logs for requests that bypass normal authentication flows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.