CVE-2025-26487

Published: Dec 8, 2025Modified: Jun 17, 2026

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 4.0

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (Secondary)

Description

Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.

Affected (1)

Products: Nokia: Infinera Mtc 9 Firmware

Nokia

1 product

Infinera Mtc 9 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nokia Infinera Mtc 9 Firmware	From 22.1.1.0275 to 23.0

Running on/with	Platform Versions
Nokia Infinera Mtc 9	All versions

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26487

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Third Party Advisory

Timeline

No history available yet.