CVE-2025-27024

Published: Jul 2, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used for SSH CLI access and are able to read all files according to the OS permission instead of remaining inside the chrooted directory position.

Affected (1)

Products: Nokia: G42 Firmware

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Nokia G42 Firmware	From 6.1.3 to 8.0

Running on/with	Platform Versions
Nokia G42	All versions

Related CWEs

Improper Handling of Insufficient Permissions or Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

References (2)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27024

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Third Party Advisory

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27024

Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Third Party Advisory

Timeline

No history available yet.