CVE-2025-27026 json
Improper Access Control Granularity impacting Infinera G42
published 2025-07-02 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-19724
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
Patch / fix
- Infinera G42 8.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 16 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Infinera G42
Classification
- Weakness
-
- CWE-1220 Insufficient Granularity of Access Control
References
-
cvcn.gov.it
/cvcn/cve/CVE-2025-27026
government-resource, third-party-advisory
-
euvd.enisa.europa.eu
/vulnerability/CVE-2025-27026
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2025-27026
- NVD CVE-2025-27026
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.