AggreGate Network Manager CVE-2025-34156

Exploitation requires only that the Tibbo AggreGate Network Manager web interface (versions below 6.40.05) be network-reachable with its CWMP/Apache Axis servlet active, so the diagnostic page at /cwmp/happyaxis.jsp is served to unauthenticated clients - the default state described. Per CVSS PR:N/UI:N, no authentication, credentials, or user interaction are needed. The practical limiting factors are deployment-driven, not vulnerability-driven: the host must be reachable by the attacker (internet-exposed instances are at highest risk, internal-only instances far less so), the installation must be older than 6.40.05, and the information gained is reconnaissance only - it does not by itself grant access, modify data, or disrupt service.

This is a moderate, confidentiality-only information disclosure flaw (CWE-497) whose signals are internally consistent and point to low-to-moderate real-world priority rather than an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) scores 6.9 and confirms remote, unauthenticated, low-complexity access, but impact is limited to Low confidentiality with no integrity or availability effect - the endpoint leaks Java system properties, server paths, and version data, not credentials or code execution. EPSS is low at 0.37% (29th percentile), the CVE is NOT in CISA KEV, and no POC flag is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The one mild amplifier is that this is reconnaissance-grade data that aids further compromise, making it a useful early step in a chain rather than a standalone high-severity issue. No key signals conflict: the network vector in the CVSS matches the described unauthenticated HTTP endpoint. Net assessment: a genuine but low-urgency issue - patch in normal cycles unless the affected product is internet-exposed.

A remote, unauthenticated attacker requests http(s)://<target>/cwmp/happyaxis.jsp directly in a browser or with curl and receives a rendered diagnostic page exposing Java system properties, filesystem/server path details, and version information. No public exploit code was identified at time of analysis, but exploitation requires only a single GET request against a default-reachable endpoint. The harvested version and path data then informs targeting of other, higher-impact vulnerabilities against the same host.