CVE-2025-27020

Published: Dec 8, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (Secondary)

Description

Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.

Affected (1)

Products: Nokia: Infinera Mtc 9 Firmware

Nokia

1 product

Infinera Mtc 9 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nokia Infinera Mtc 9 Firmware	From 22.1.1.0275 to 23.0

Running on/with	Platform Versions
Nokia Infinera Mtc 9	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27020

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Third Party Advisory

Timeline

No history available yet.