CVE-2025-34156

Tibbo AggreGate Network Manager < 6.40.05 System Information Exposure

State: Published
Severity: 6.9 Medium
Published: Oct 23, 2025
Updated: May 14, 2026
Reserved: Apr 15, 2025

Description

Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could aid further compromise.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Affected Products

Product	Versions
AggreGate Network ManagerTibbo Systems	before 6.40.05Affected

References

https://aggregate.digital/downloads.htmlpatch
https://aggregate.digital/products/network-manager.htmlproduct
https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-system-information-exposurethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.