CVE-2025-34156 is an information disclosure vulnerability in Tibbo Systems AggreGate Network Manager before version 6.40.05. The vulnerability arises from an unauthenticated endpoint (/cwmp/happyaxis.jsp) that reveals sensitive system details including Java system properties, server paths, and version information. This exposure can aid attackers by providing system insights that may facilitate further attacks. The CVSS 4.0 base score is 6.9, reflecting a network attack vector with low complexity and no required privileges or user interaction. The vulnerability is categorized under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). No patch or official fix information is provided, and no known exploits have been reported.

The vulnerability allows unauthorized users to access sensitive system information without authentication. This information disclosure could help attackers understand the system environment and potentially craft more effective attacks. However, the vulnerability does not directly allow system compromise or data modification. The CVSS score of 6.9 indicates a medium severity impact primarily due to information exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint if possible, such as by network segmentation or access control rules. Monitor vendor communications for updates regarding patches or official mitigations.