PT-2025-43533 · Tibbo · Tibbo Aggregate Network Manager

Alex Williams · Published 2025-10-23 · Updated 2025-10-23 · CVE-2025-34156

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tibbo AggreGate Network Manager versions prior to 6.40.05

Description The software reveals sensitive system information through an unauthenticated endpoint. Specifically, the /cwmp/happyaxis.jsp endpoint allows unauthorized access to Java system properties, server path details, and version information. This information disclosure could potentially assist in further compromise of the system.

Recommendations Update Tibbo AggreGate Network Manager to version 6.40.05 or later.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-34156

Affected Products

Tibbo Aggregate Network Manager

References · 7

• https://aggregate.digital/downloads.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34156 · Security Note
• https://twitter.com/CVEnew/status/1981401988504911893 · Twitter Post
• https://aggregate.digital/products/network-manager.html · Note
• https://twitter.com/VulmonFeeds/status/1981448557065367793 · Twitter Post
• https://t.me/CVEtracker/35586 · Telegram Post
• https://vulncheck.com/advisories/tibbo-aggregate-network-manager-system-information-exposure · Note