PT-2025-43532

Name of the Vulnerable Software and Affected Versions Tibbo AggreGate Network Manager versions prior to 6.40.05 Description The login functionality exhibits a discrepancy in authentication failure messages. These messages vary depending on whether a provided username exists, potentially enabling ...

CVE-2025-34156: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Tibbo AggreGate Network Manager 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could ai...

CVE-2025-34155: Observable Response Discrepancy

Tibbo AggreGate Network Manager 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can...

PT-2025-43533

Name of the Vulnerable Software and Affected Versions Tibbo AggreGate Network Manager versions prior to 6.40.05 Description The software reveals sensitive system information through an unauthenticated endpoint. Specifically, the /cwmp/happyaxis.jsp endpoint allows unauthorized access to Java syst...

Tibbo Aggregate Network Manager UploaderTempFileController Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tibbo Aggregate Network Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the UploaderTempFileController class. The issue results from the lack of...