Versa Concerto Authentication Bypass File Write Remote Code Execution
Versa · Concerto
A flaw in the Traefik reverse proxy configuration of Versa Concerto, the SD-WAN orchestration platform, allows an authentication bypass that grants access to administrative endpoints, and a race condition (TOCTOU) in the Spack upload endpoint can be combined with that access to manipulate path loading. An attacker with only network access to the platform, requiring no credentials or user interaction, can achieve remote code execution by winning the race between the file check and the write.
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 months after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+2 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.