{"id":"CVE-2025-27023","aliases":["EUVD-2025-19696","GHSA-34v7-fvgc-mxc2"],"status":"published","title":"Improper Input Validation in Infinera G42","description":"Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows remote authenticated users to read all OS files \nvia crafted CLI commands.\n\n\nDetails: The web interface based management of the Infinera G42 appliance enables the feature of\n executing a restricted set of commands. This feature \nalso offers the option to execute a script-file already present on the target\n device. When a non-script or incorrect file is specified, the content \nof the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00547,"percentile":0.46365,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2025-07-02T09:07:06Z","modified":"2026-06-17T09:02:46Z","products":[{"vendor":"infinera","product":"g42"},{"vendor":"nokia","product":"g42_firmware"}],"references":[{"url":"https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27023","tags":["government-resource","Third Party Advisory"]},{"url":"https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27023","tags":["vdb-entry","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27023"},{"url":"https://github.com/advisories/GHSA-34v7-fvgc-mxc2"}],"sources":{"cve":[{"id":"CVE-2025-27023","title":"Improper Input Validation in Infinera G42","description":"Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows remote authenticated users to read all OS files \nvia crafted CLI commands.\n\n\nDetails: The web interface based management of the Infinera G42 appliance enables the feature of\n executing a restricted set of commands. This feature \nalso offers the option to execute a script-file already present on the target\n device. When a non-script or incorrect file is specified, the content \nof the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.","status":"published","published":"2025-07-02T09:07:06.957Z","modified":"2025-07-02T13:14:35.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-19696","description":"Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows remote authenticated users to read all OS files \nvia crafted CLI commands.\n\n\nDetails: The web interface based management of the Infinera G42 appliance enables the feature of\n executing a restricted set of commands. This feature \nalso offers the option to execute a script-file already present on the target\n device. When a non-script or incorrect file is specified, the content \nof the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.","status":"published","published":"2025-07-02T09:07:06Z","modified":"2025-07-02T13:14:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:14.813568Z"}],"ghsa":[{"id":"GHSA-34v7-fvgc-mxc2","title":"Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows...","description":"Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows remote authenticated users to read all OS files \nvia crafted CLI commands.\n\n\nDetails: The web interface based management of the Infinera G42 appliance enables the feature of\n executing a restricted set of commands. This feature \nalso offers the option to execute a script-file already present on the target\n device. When a non-script or incorrect file is specified, the content \nof the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.","status":"published","published":"2025-07-02T12:32:12Z","modified":"2025-07-02T12:32:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:02:53.302581Z"}],"nvd":[{"id":"CVE-2025-27023","description":"Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows remote authenticated users to read all OS files \nvia crafted CLI commands.\n\n\nDetails: The web interface based management of the Infinera G42 appliance enables the feature of\n executing a restricted set of commands. This feature \nalso offers the option to execute a script-file already present on the target\n device. When a non-script or incorrect file is specified, the content \nof the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.","status":"published","published":"2025-07-02T10:15:22.54Z","modified":"2026-06-17T09:02:46.717Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:11:15.754475Z"}]}}