Medium severity · published Jul 2, 2025
CVE-2025-27026
Improper Access Control Granularity impacting Infinera G42
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
G4
G42 · Infinera
6.1.3 before 8.0 · source: vendor
GF
G42 Firmware · Nokia
6.1.3 before 8.0 · source: NVD
Affected product
G4
G42
Infinera
More from G42
8.8
CVE-2025-27025
Improper File Access in Infinera G42
7.8
CVE-2025-27021
Operating System Misconfiguration in Infinera G42
6.5
CVE-2025-27024
Improper File Access in Infinera G42
6.5
CVE-2025-27023
Improper Input Validation in Infinera G42
6.5
CVE-2025-27022
Path Traversal Vulnerability in Infinera G42