Skip to content
Cloudflare Docs

2025-06-02

This week’s roundup highlights five high-risk vulnerabilities affecting SD-WAN, load balancers, and AI platforms. Several flaws enable unauthenticated remote code execution or authentication bypass.

Key Findings

  • Versa Concerto SD-WAN (CVE-2025-34026, CVE-2025-34027): Authentication bypass vulnerabilities allow attackers to gain unauthorized access to SD-WAN management interfaces, compromising network segmentation and control.
  • Kemp LoadMaster (CVE-2024-7591): Remote Code Execution vulnerability enables attackers to execute arbitrary commands, potentially leading to full device compromise within enterprise load balancing environments.
  • AnythingLLM (CVE-2024-0759): Server-Side Request Forgery (SSRF) flaw allows external attackers to force the LLM backend to make unauthorized internal network requests, potentially exposing sensitive internal resources.
  • Anyscale Ray (CVE-2023-48022): Remote Code Execution vulnerability affecting distributed AI workloads, allowing attackers to execute arbitrary code on Ray cluster nodes.
  • Server-Side Request Forgery (SSRF) - Generic & Obfuscated Payloads: Ongoing advancements in SSRF payload techniques observed, including obfuscation and expanded targeting of cloud metadata services and internal IP ranges.

Impact

These vulnerabilities expose critical infrastructure across networking, AI platforms, and SaaS integrations. Unauthenticated RCE and auth bypass flaws in Versa Concerto, Kemp LoadMaster, and Anyscale Ray allow full system compromise. AnythingLLM and SSRF payload variants expand attack surfaces into internal cloud resources, sensitive APIs, and metadata services, increasing risk of privilege escalation, data theft, and persistent access.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed Ruleset 100764Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34027LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100765Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34026LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100766Kemp LoadMaster - Remote Code Execution - CVE:CVE-2024-7591LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100767AnythingLLM - SSRF - CVE:CVE-2024-0759LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100768Anyscale Ray - Remote Code Execution - CVE:CVE-2023-48022LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100781SSRF - Generic PayloadsN/ADisabledThis is a New Detection
Cloudflare Managed Ruleset 100782SSRF - Obfuscated PayloadsN/ADisabledThis is a New Detection