What’s Vulnerable › Vulnerabilities

CVE-2025-34155: Tibbo AggreGate Network Manager < 6.40.05 Login Functionality User Enumeration

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-23 · updated 2026-10-23
• Weakness: CWE-204

Description

Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks.

Affected products

• Tibbo Systems AggreGate Network Manager: before 6.40.05 — fixed in 6.40.05

How to fix

Upgrade to a fixed version: Tibbo Systems AggreGate Network Manager 6.40.05. Check the vendor advisory for mitigations.

References

• https://aggregate.digital/downloads.html
• https://aggregate.digital/products/network-manager.html
• https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-login-functionality-user-enumeration

Get alerted when CVE-2025-34155 or the next vulnerability affects your stack