AggreGate Network Manager CVE-2025-34155
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AggreGate login endpoint
-
DeliverySubmit usernames with invalid passwords
-
ExploitCompare response discrepancies
-
ExecutionCompile valid account list
-
ImpactLaunch targeted credential-stuffing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Response uniformity
|
| Exploitation Conditions | Requires only network reachability to the AggreGate Network Manager login functionality in versions below 6.40.05; no authentication, no user interaction, and no special configuration are needed (PR:N/UI:N against the default login endpoint). The practical limit on impact is that the flaw only leaks whether a username is valid - it does not by itself grant access, so its value depends on the attacker subsequently performing brute-force or credential-stuffing against the enumerated accounts, and on weak or reused passwords existing on those accounts. |
| Impact | This is a genuine but low-priority information-disclosure flaw, not a high-impact issue despite the moderate 6.9 CVSS 4.0 score. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability, which inflates the base score, but the only impact is VC:L - confidentiality limited to leaking valid usernames via observable login response discrepancies (CWE-204). There is no integrity or availability impact (VI:N/VA:N) and no scope change. EPSS is low at 0.53% (43rd percentile), consistent with the fact that this is an enumeration primitive rather than a directly exploitable code-execution or data-breach bug. There is no CISA KEV listing and no public exploit referenced in the provided intelligence, so no evidence of active exploitation. The signals are mutually consistent: easy to reach but low real-world consequence on its own. Its practical risk is as a precursor that amplifies downstream brute-force or credential-stuffing campaigns, so it should be patched as part of normal hygiene but does not warrant emergency action. |
| Exploit ScenarioDerived | An unauthenticated remote attacker submits login attempts to the AggreGate Network Manager web interface with varying usernames and observes that failure messages differ between existing and non-existent accounts. By scripting these requests, the attacker compiles a list of valid account identifiers and then focuses password-guessing or credential-stuffing attacks on confirmed accounts. No public proof-of-concept exploit was identified in the provided data; given AV:N/AC:L, exploitation is trivial to automate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Username enumeration in Tibbo AggreGate Network Manager before 6.40.05 lets an unauthenticated remote attacker distinguish valid accounts from invalid ones because the login endpoint returns different failure responses depending on whether the supplied username exists. The flaw does not grant access on its own; its value is as a reconnaissance step that feeds targeted brute-force or credential-stuffing against confirmed accounts, so real-world risk depends on weak or reused passwords. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is low (0.53%, roughly the 43rd percentile), consistent with a genuine but low-priority information-disclosure issue rather than a high-impact one.
RemediationAI
Vendor-released patch: upgrade AggreGate Network Manager to 6.40.05 or later, available from https://aggregate.digital/downloads.html, which normalizes the login responses so that valid and invalid usernames are indistinguishable; this is the only complete fix and should be prioritized on any instance exposed to untrusted networks. Until upgrading is possible, compensating controls should be applied with their trade-offs in mind: restrict reachability of the login endpoint to trusted management networks, VPN, or an allow-list of source addresses via firewall rules, which removes remote enumeration but blocks legitimate off-network administrators; enforce rate limiting or temporary account lockout on repeated failed logins, which raises the cost of brute-force and credential stuffing but can be abused for denial of service against known accounts if thresholds are aggressive; and require multi-factor authentication plus a strong, unique password policy, which neutralizes the follow-on credential attack but does not stop the enumeration itself. Monitoring for high volumes of failed authentication attempts from single sources can detect enumeration attempts in progress. None of these workarounds should be treated as a substitute for the 6.40.05 upgrade.
Affected ProductsAI
Tibbo AggreGate Network Manager versions below 6.40.05 are affected, including all earlier 6.x releases up to and including 6.40.04; version 6.40.05 is the first release in which the login response discrepancy is corrected. No CPE identifiers were supplied with the advisory data, so scope must be determined from the product version string reported by the installation. Vendor product and download references are https://aggregate.digital/products/network-manager.html and https://aggregate.digital/downloads.html, and the originating advisory is https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-login-functionality-user-enumeration. The assessment is that this is genuine but low-priority information disclosure affecting the default login endpoint, and the affected surface is any deployment reachable over the network.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the authentication/login functionality of AggreGate Network Manager, a Tibbo platform used for unified management of IoT devices, networks, and industrial systems. The root cause is CWE-204 (Observable Response Discrepancy): the application returns differing authentication-failure responses - for example distinct error text, error codes, redirect behavior, or measurable timing differences - when a submitted username is unknown versus when it is known but the password is wrong. Because the responses are externally observable over the normal HTTP(S) login interface, an attacker can script repeated submissions and build a list of valid account identifiers without ever authenticating. The provided CPE data does not enumerate specific platform strings; affected coverage is defined by the product version range rather than by a CPE entry, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the impact is confined to confidentiality of low-value information, with no integrity or availability effect and no scope change.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated login endpoint gives AV:N/AC:L/PR:N/UI:N; only limited confidentiality (username validity) leaks, so C:L with I:N/A:N and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB