CVE-2025-26489 Improper input validation in Netconf service in Infinera MTC-9
Remote authenticated users can crash the Netconf service and reboot the Infinera MTC-9 appliance via crafted XML payloads, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-26489?
CVE-2025-26489 is a medium-severity denial of service vulnerability in Infinera MTC-9, published on 8 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
Weakness: CWE-20
Which versions are affected by CVE-2025-26489?
It affects 1 product.
Products include Nokia Infinera Mtc-9 Firmware.
How do I fix CVE-2025-26489?
No fix has been published for CVE-2025-26489 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-26489 being exploited?
There is no known exploitation of CVE-2025-26489 in the wild and no public exploit code.
Other vulnerabilities in Infinera MTC-9
- CVE-2025-27019 Remote shell service (RSH) in Infinera MTC-9
- CVE-2025-27020 Improper configuration of SSH service in Infinera MTC-9
- CVE-2025-26487 Server Side Request Forgery (SSRF) in the web server of Infinera MTC-9
- CVE-2025-26488 Improper input validation in XML Management service in Infinera MTC-9
Sources
Also known as GHSA-q9m8-v6jr-whjw.