CVE-2025-27026: Improper Access Control Granularity impacting Infinera G42
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27026?
CVE-2025-27026 is classified with a high severity rating due to its potential to disrupt management interfaces.
How do I fix CVE-2025-27026?
To fix CVE-2025-27026, ensure that the CLI deactivation feature in the WebGUI is properly secured or disabled until a patch is applied.
What are the potential impacts of CVE-2025-27026?
The potential impacts of CVE-2025-27026 include denial of service to management interfaces, leading to loss of control over the Infinera G42 device.
Who is affected by CVE-2025-27026?
Administrators of Infinera G42 devices running version R6.1.3 are affected by CVE-2025-27026.
Is there a patch available for CVE-2025-27026?
As of now, a patch specifically for CVE-2025-27026 has not been released, so it's crucial to monitor updates from Infinera.