CVE-2025-27026

4.9 mediumEPSS 0.4%

Medium (4.9) in nokia g42 firmware. EPSS 0.4% chance of exploitation in the next 30 days.

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-1220
Published: 2025-07-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nokia:g42_firmware

References

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27026
https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27026

Check your stack JSON