CVE-2025-26489CWE-20

CVE-2025-26489

Medium · published December 8, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
25.3
In the wild
Unconfirmed
What it is

Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and

reboot the appliance, thus causing a DoS condition, via crafted XML

payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-12-08T14:15Z
Affected products (1)
ProductVersionsFixed in
nokia/infinera_mtc-9_firmware≥ 22.1.1.0275, < 23.023.0
References (1)
https://www.cve.org/CVERecord?id=CVE-2025-26489 · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
EPSS history
Timeline
  • 08 DEC 08:56Z
    Improper input validation in Netconf service in Infinera MTC-9
    cvelistv5