Vulnerability in Tibbo Systems Aggregate Network Manager
CVE-2025-34156
Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could aid further compromise.
EPSS: 0.003 (27.2th percentile) — read the EPSS interpretation.
Affected products
- Tibbo Systems Aggregate Network Manager — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)