CVE-2025-27023 Improper Input Validation in Infinera G42

Medium 6.5 Published 2 Jul 2025 Updated 2 Jul 2025

Remote authenticated users can read arbitrary OS files on Infinera G42 devices via crafted CLI commands in the web interface.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-27023?

CVE-2025-27023 is a medium-severity path traversal vulnerability in Infinera G42, published on 2 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands.

Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.

Weakness: CWE-20

Which versions are affected by CVE-2025-27023?

It affects 1 product.

Products include Nokia G42 Firmware.

How do I fix CVE-2025-27023?

No fix has been published for CVE-2025-27023 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-27023 being exploited?

There is no known exploitation of CVE-2025-27023 in the wild and no public exploit code.

Sources

Also known as GHSA-34v7-fvgc-mxc2.