CVE-2025-27023

Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target device. When a non-script or incorrect file is specified, the content of the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27023
https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27023

Configurations

No configuration.

History

03 Jul 2025, 15:13

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-02 10:15

Updated : 2025-07-03 15:13

NVD link : CVE-2025-27023

Mitre link : CVE-2025-27023

CVE.ORG link : CVE-2025-27023

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-27023", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-07-02T10:15:22.540", "references": [{"url": "https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27023", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27023", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Lack or insufficent input validation in WebGUI CLI web in Infinera G42 \nversion R6.1.3 allows remote authenticated users to read all OS files \nvia crafted CLI commands.\n\n\nDetails: The web interface based management of the Infinera G42 appliance enables the feature of\n executing a restricted set of commands. This feature \nalso offers the option to execute a script-file already present on the target\n device. When a non-script or incorrect file is specified, the content \nof the file is shown along with an error message. Due to an execution of the http service with a privileged user all files on the file system can be viewed this way."}, {"lang": "es", "value": "La falta o insuficiencia de validaci\u00f3n de entrada en la interfaz de l\u00ednea de comandos WebGUI de Infinera G42 versi\u00f3n R6.1.3 permite a los usuarios remotos autenticados leer todos los archivos del sistema operativo mediante comandos CLI espec\u00edficos. Detalles: La gesti\u00f3n basada en la interfaz web del dispositivo Infinera G42 permite ejecutar un conjunto restringido de comandos. Esta funci\u00f3n tambi\u00e9n permite ejecutar un archivo de script ya presente en el dispositivo de destino. Cuando se especifica un archivo incorrecto o que no es un script, se muestra su contenido junto con un mensaje de error. Gracias a la ejecuci\u00f3n del servicio http con un usuario con privilegios, todos los archivos del sistema de archivos se pueden visualizar de esta manera."}], "lastModified": "2025-07-03T15:13:53.147", "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}