CVE-2025-27026CWE-1220

Improper Access Control Granularity impacting Infinera G42

Medium · published July 2, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42

version R6.1.3 allows an authenticated administrator to make other

management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No

confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.9th percentile
Weakness
CWE-1220 · Insufficient Granularity of Access Control
Published
2025-07-02T13:42Z
EPSS history
Timeline
  • 02 JUL 13:42Z
    Improper Access Control Granularity impacting Infinera G42
    cvelistv5