PT-2025-27618 · Infinera · Infinera G42

Published 2025-07-02 · Updated 2025-07-02 · CVE-2025-27023

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Infinera G42 version R6.1.3

Description: The issue is related to insufficient input validation in the WebGUI CLI web interface of the Infinera G42 appliance. This allows remote authenticated users to read all OS files via crafted CLI commands. The web interface enables the execution of a restricted set of commands and offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to the execution of the http service with a privileged user, all files on the file system can be viewed this way.

Recommendations: For Infinera G42 version R6.1.3, consider restricting access to the WebGUI CLI web interface until a patch is available. As a temporary workaround, limit the execution of commands and script-files to only necessary and authorized users. Avoid using the WebGUI CLI web interface for executing commands or script-files that could potentially reveal sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2025-08689

CVE-2025-27023

Affected Products

Infinera G42

References · 7

• https://osv.dev/vulnerability/CVE-2025-27023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27023 · Security Note
• https://bdu.fstec.ru/vul/2025-08689 · Security Note
• https://twitter.com/CVEnew/status/1940345966537658832 · Twitter Post
• https://cvcn.gov.it/cvcn/cve/CVE-2025-27023 · Note
• https://t.me/cvenotify/127365 · Telegram Post
• https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27023 · Note