CVE-2025-27021
BaseFortify
Publication date: 2025-07-02
Last updated on: 2026-02-11
Assigner: ENISA
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nokia | g42_firmware | From 6.1.3 (inc) to 7.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is caused by a misconfiguration in the sudoers configuration of the Infinera G42 operating system version R6.1.3. It allows low privileged OS users to execute the 'devmem' command as super user without a password. The 'devmem' command lets users read and write arbitrary physical memory addresses, which can lead to sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with low privileges to read and write physical memory, potentially exposing sensitive information, causing denial of service, or escalating their privileges to gain full control over the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if low privileged users have sudo access to the devmem command without a password. Running the command "sudo -l" as a low privileged user will list allowed sudo commands and should reveal if devmem is executable with elevated privileges without a password prompt.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing or restricting sudo access to the devmem command for low privileged users, ensuring that sudo requires a password for executing devmem, or removing the devmem command from the sudoers configuration to prevent unauthorized read/write access to physical memory.