This vulnerability (CVE-2025-34155) affects Tibbo AggreGate Network Manager before version 6.40.05. The issue is an observable response discrepancy in the login process: error messages reveal whether a username is valid or not. This side channel enables attackers without authentication to confirm valid account identifiers, facilitating user enumeration. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. No official patch or fix is currently documented, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated remote attackers to distinguish valid usernames from invalid ones via differing authentication failure messages. This user enumeration can increase the risk of subsequent targeted attacks such as brute-force or credential stuffing. There is no direct impact on confidentiality, integrity, or availability reported beyond this enumeration capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is documented, organizations should monitor vendor communications for updates. In the meantime, consider implementing compensating controls such as uniform error messages on login failures to prevent user enumeration, and apply rate limiting or account lockout policies to reduce brute-force risks.