Vulnerability · Published Oct 23, 2025 · Assigned by VulnCheck

CVE-2025-34155Tibbo AggreGate Network Manager < 6.40.05 Login Functionality User Enumeration

Medium 6.9

In plain English

A medium-severity security flaw in AggreGate Network Manager from Tibbo Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 55.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks.

Affected products (as reported)

Vendor	Product	Versions
Tibbo Systems	AggreGate Network Manager	0 – before 6.40.05

Weakness: CWE-204 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://aggregate.digital/downloads.html patch
https://aggregate.digital/products/network-manager.html product
https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-login-functionality-user-enumeration third-party-advisory