CVE-2025-27026 MEDIUM

CVE-2025-27026: Improper Access Control Granularity impacting Infinera G42

Vendor Infinera
Product G42
Weakness CWE-1220
Published July 2, 2025
Last update July 2, 2025
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.

Key dates

02Disclosure timeline

July 2, 2025 CVE published
July 2, 2025 Record updated