CVE-2025-27026 json
Improper Access Control Granularity impacting Infinera G42
published last yr. modified 4mo ago also EUVD-2025-19724
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
Patch / fix
- Infinera G42 8.0
Is CVE-2025-27026 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Infinera G42
Classification
- Weakness
-
- CWE-1220 Insufficient Granularity of Access Control
References
-
cvcn.gov.it
/cvcn/cve/CVE-2025-27026
government-resource, third-party-advisory
-
euvd.enisa.europa.eu
/vulnerability/CVE-2025-27026
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2025-27026
- NVD CVE-2025-27026
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.