Critical · published December 8, 2025
🚨 A remote shell service flaw in Infinera MTC-9 could let attackers sail through the system like a ship without a captain! ⚓️ Think of it like a hotel that gives out keycards to anyone without checking IDs—just walk in and access any room. This vulnerability allows attackers to activate a reverse shell through password-less accounts, zipping past security checks! An attacker can gain full system access, potentially leading to unauthorized data exposure, system manipulation, or even complete control over the infrastructure. Imagine someone entering your home without knocking, rifling through your belongings, and taking anything they want! The stakes are high here!
Think of it like a hotel that gives out keycards to anyone without checking IDs—just walk in and access any room. This vulnerability allows attackers to activate a reverse shell through password-less accounts, zipping past security checks! This vulnerability in Infinera MTC-9 allows unauthorized access by exploiting password-less user accounts to trigger a reverse shell connection, which could be used for remote code execution and privilege escalation.
An attacker can gain full system access, potentially leading to unauthorized data exposure, system manipulation, or even complete control over the infrastructure. Imagine someone entering your home without knocking, rifling through your belongings, and taking anything they want! The stakes are high here! Immediate remediation is critical! Upgrade Infinera MTC-9 from version R22.1.1.0275 to R23.0 or later, and ensure all password-less accounts are either disabled or secured with proper authentication measures. Regular audits of user accounts are also essential to prevent unauthorized access. This issue is fixable! By taking these steps, you can become a security hero and lock it down in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| nokia/infinera_mtc-9_firmware | ≥ 22.1.1.0275, < 23.0 | 23.0 |