CVE-2025-34156 Tibbo AggreGate Network Manager < 6.40.05 System Information Exposure
Unauthenticated access to a specific endpoint exposes sensitive system information, aiding potential further attacks on Tibbo AggreGate Network Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34156?
CVE-2025-34156 is a medium-severity vulnerability in Tibbo Systems AggreGate Network Manager, published on 23 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could aid further compromise.
Weakness: CWE-497
Which versions are affected by CVE-2025-34156?
How do I fix CVE-2025-34156?
No fix has been published for CVE-2025-34156 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34156 being exploited?
There is no known exploitation of CVE-2025-34156 in the wild and no public exploit code.
Sources
Also known as GHSA-xrxv-q9j2-38v5.