Critical Unpatched Vulnerabilities in Versa Concerto Expose Systems to Auth Bypass and RCE

Multiple critical vulnerabilities in Versa Networks’ Concerto platform remain unpatched, exposing enterprise networks to authentication bypass and remote code execution (RCE) attacks. These flaws, rated CVSS 10.0, affect the SD-WAN solution’s Spring Boot and Docker components, allowing attackers to compromise systems without authentication. Public disclosure occurred on May 21, 2025, after Versa Networks failed to address the issues during the 90-day disclosure period¹.

Technical Breakdown of the Vulnerabilities

The attack chain begins with an authentication bypass (CVE-2025-34027) in Spring Boot’s AuthenticationFilter, where URL-encoded semicolons (%3B) evade security checks. Researchers demonstrated exploitation via crafted requests like /portalapi/v1/users/username/admin;%2fv1%2fping, granting access to restricted API endpoints². This flaw enables subsequent attacks against three other critical components:

CVE	Type	Exploitation Path
CVE-2025-34026	Actuator Endpoint Bypass	Dropping `X-Real-Ip` header via `Connection: X-Real-IP`
CVE-2025-34025	Container Escape	Overwriting host-mounted `/usr/bin/test`

The most severe vulnerability allows RCE through a race condition in the /portalapi/v1/package/spack/upload endpoint. Attackers can write malicious .so files to /etc/ld.so.preload during the brief window between file upload and deletion³. Health-check mechanisms then execute the payload via system curl commands.

Mitigation Strategies

Organizations using Versa Concerto should implement these immediate countermeasures:

Block URL-encoded semicolons at WAF/reverse proxy layers
Drop HTTP requests containing Connection: X-Real-IP headers
Monitor access to /actuator endpoints for unauthorized activity

Network segmentation should isolate Concerto management interfaces, and Docker configurations must be audited for host-mounted directories. The vulnerabilities exemplify risks in cloud-native architectures, particularly misconfigured container permissions and time-of-check-to-time-of-use (TOCTOU) flaws in file operations.

Disclosure Timeline and Vendor Response

Researchers reported these issues to Versa Networks on February 13, 2025, with no remediation provided by the April 23 deadline. Public disclosure followed on May 21 after additional follow-ups went unanswered¹. The extended exposure window increases risks for enterprises using Concerto for SD-WAN management, particularly in government and financial sectors.

These vulnerabilities highlight systemic challenges in vulnerability management for embedded network appliances. The concatenation of flaws enables a full attack chain from initial access to host takeover, emphasizing the need for defense-in-depth strategies in SD-WAN deployments.