CVE-2025-27023
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-02

Last updated on: 2026-02-11

Assigner: ENISA

Description
Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-02
Last Modified
2026-02-11
Generated
2026-05-07
AI Q&A
2025-07-02
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
nokia g42_firmware From 6.1.3 (inc) to 7.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is due to lack or insufficient input validation in the WebGUI CLI web interface of the Infinera G42 version R6.1.3. It allows remote authenticated users to read all operating system files by using specially crafted CLI commands. The web interface allows execution of a restricted set of commands and scripts, but when a non-script or incorrect file is specified, the file's content is displayed along with an error message. Because the HTTP service runs with privileged user rights, this flaw enables viewing of all files on the system.


How can this vulnerability impact me? :

This vulnerability can impact you by allowing a remote authenticated user to read any file on the operating system of the affected device. This could lead to exposure of sensitive information, configuration files, or credentials stored on the system, potentially compromising the security and confidentiality of the device and network it is part of.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart