« Volver al listado

CVE-2025-27026

Estado: AnalizadaMedia (4.9)—

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nokia — G42 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27026",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27026",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-02T20:22:47.748223Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
      "affectedData": [
        {
          "vendor": "Infinera",
          "product": "G42",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.3",
              "lessThan": "8.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-02T14:15:23.900",
  "references": [
    {
      "url": "https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27026",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"
    },
    {
      "url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27026",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1220"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 \nversion R6.1.3 allows an authenticated administrator to make other \nmanagement interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No \nconfirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control."
    },
    {
      "lang": "es",
      "value": "La ausencia de una función de doble verificación en la interfaz web para la desactivación de la CLI en Infinera G42 versión R6.1.3 permite a un administrador autenticado desactivar otras interfaces de administración a través de interfaces locales y de red. La desactivación de la CLI mediante la interfaz web no solo detiene la interfaz, sino que también desactiva el acceso a Linux Shell, la interfaz web y la consola serie física. No se solicita confirmación al desactivarla. Al perder el acceso a estos servicios, los administradores de dispositivos corren el riesgo de perder completamente el control del dispositivo."
    }
  ],
  "lastModified": "2026-06-17T09:02:47.053",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:nokia:g42_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3DC0C26-02A8-48FA-9CFE-CA540AA5106B",
              "versionEndExcluding": "8.0",
              "versionStartIncluding": "6.1.3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:nokia:g42:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "631A98C4-038C-40FA-A9AC-0A6155EDB9F5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"
}