CVE-2025-27023

Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27023	Third Party Advisory
https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27023	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:nokia:g42_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nokia:g42:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-07-02 10:15

Updated : 2026-02-11 21:31

NVD link : CVE-2025-27023

Mitre link : CVE-2025-27023

CVE.ORG link : CVE-2025-27023

JSON object : View

Products Affected

nokia

g42_firmware
g42

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2025-27023", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-07-02T10:15:22.540", "references": [{"url": "https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27023", "tags": ["Third Party Advisory"], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27023", "tags": ["Third Party Advisory"], "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows remote authenticated users to read all OS files \nvia crafted CLI commands.\n\n\nDetails: The web interface based management of the Infinera G42 appliance enables the feature of\n executing a restricted set of commands. This feature \nalso offers the option to execute a script-file already present on the target\n device. When a non-script or incorrect file is specified, the content \nof the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way."}, {"lang": "es", "value": "La falta o insuficiencia de validaci\u00f3n de entrada en la interfaz de l\u00ednea de comandos WebGUI de Infinera G42 versi\u00f3n R6.1.3 permite a los usuarios remotos autenticados leer todos los archivos del sistema operativo mediante comandos CLI espec\u00edficos. Detalles: La gesti\u00f3n basada en la interfaz web del dispositivo Infinera G42 permite ejecutar un conjunto restringido de comandos. Esta funci\u00f3n tambi\u00e9n permite ejecutar un archivo de script ya presente en el dispositivo de destino. Cuando se especifica un archivo incorrecto o que no es un script, se muestra su contenido junto con un mensaje de error. Gracias a la ejecuci\u00f3n del servicio http con un usuario con privilegios, todos los archivos del sistema de archivos se pueden visualizar de esta manera."}], "lastModified": "2026-02-11T21:31:06.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:nokia:g42_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EE9ECA9-CB8C-44D6-B221-E1596A69EC40", "versionEndExcluding": "7.1", "versionStartIncluding": "6.1.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nokia:g42:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "631A98C4-038C-40FA-A9AC-0A6155EDB9F5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}