PT-2025-27624 · Infinera · Infinera G42

Published 2025-07-02 · Updated 2026-02-11 · CVE-2025-27026

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Infinera G42 version R6.1.3

Description: A missing double-check feature in the WebGUI for CLI deactivation allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop the CLI interface but also deactivates Linux Shell, WebGUI, and Physical Serial Console access. No confirmation is asked at deactivation time, putting device administrators at risk of completely losing device control.

Recommendations: For Infinera G42 version R6.1.3, consider temporarily restricting access to the WebGUI CLI deactivation feature until a patch is available to prevent unintended deactivation of management interfaces. As a mitigation measure, ensure that administrators are aware of the potential consequences of deactivating the CLI via the WebGUI and implement procedures to verify the intended action before deactivation.

Fix

Weakness Enumeration

CWE-1220

Related Identifiers

BDU:2025-08681

CVE-2025-27026

Affected Products

Infinera G42

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-27026 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27026 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08681 · Security Note
• https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27026 · Note
• https://t.me/cveNotify/151768 · Telegram Post
• https://cvcn.gov.it/cvcn/cve/CVE-2025-27026 · Note
• https://twitter.com/CVEnew/status/1940414195129807124 · Twitter Post