Authentication Bypass Vulnerability in Versa Concerto SD-WAN Platform

What changed

The Versa Concerto SD-WAN orchestration platform has been found to have an improper authentication vulnerability. This flaw resides in the configuration of the Traefik reverse proxy, which can be exploited to bypass authentication mechanisms.

As a result, attackers may gain unauthorized access to administrative endpoints, including sensitive internal Actuator endpoints that can provide access to heap dumps and trace logs.

Who is affected

The vulnerability impacts users of the Versa Concerto platform, specifically versions 12.1.2 through 12.2.0. It is important to note that additional versions may also be at risk.

Organizations utilizing this SD-WAN orchestration solution should assess their deployments to determine if they are affected by this vulnerability.

• Versa Concerto SD-WAN orchestration platform (versions 12.1.2 to 12.2.0)
• Organizations relying on Versa for network management
• IT security teams managing SD-WAN solutions

What to do

Organizations using the affected versions of Versa Concerto should take immediate action to mitigate the risk posed by this vulnerability. It is advisable to review the configuration of the Traefik reverse proxy and implement necessary security measures.

Additionally, monitoring for any unauthorized access attempts and ensuring that administrative endpoints are secured should be prioritized.

• Review and update Traefik reverse proxy configurations
• Monitor access logs for suspicious activity
• Consider upgrading to a patched version of Versa Concerto