Read the docs
TI-2025-19892 Aliases CVE-2025-27021GHSA-9w8q-pjh8-6h83

Operating System Misconfiguration in Infinera G42

Priority LOW 35CWE-266Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-266.

Summary

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory. Details: The output of "sudo -l" reports the presence of "devmem" command executable as super user without using a password. This command allows to read and write an arbitrary memory area of the target device, specifying an absolute address.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed G42 (Infinera): 7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NokiaG426.1.3 to before 7.17.1Patch availableCNA
  • G42 VendorNokia Affected 6.1.3 to before 7.1 Fixed in 7.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:nokia:g42_firmware:*:*:*:*:*:*:*:*6.1.3 to before 7.1VulnerableNokia
cpe:2.3:h:nokia:g42:-:*:*:*:*:*:*:*not specified by NVDRunning onNokia
  • cpe:2.3:o:nokia:g42_firmware:*:*:*:*:*:*:*:* Versions 6.1.3 to before 7.1 Vulnerable ·Nokia
  • cpe:2.3:h:nokia:g42:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Nokia

Remediation

  • Fix · CNA G42 (Infinera) Fixed in 7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Infinera G42 7.1

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-19896 Improper File Access in Infinera G42Priority MEDIUM 41
    • TI-2025-19893 Path Traversal Vulnerability in Infinera G42Priority MEDIUM 40
    • TI-2025-19894 Improper Input Validation in Infinera G42Priority LOW 30
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27021
  2. 2026-10-03 Alias added: GHSA-9w8q-pjh8-6h83

References

Advisory 2

  • TI-2025-19893 Path Traversal Vulnerability in Infinera G42 CVSS 3.1HIGH 7.5
  • TI-2025-19894 Improper Input Validation in Infinera G42 CVSS 3.1MEDIUM 6.5
  • TI-2025-19895 Improper File Access in Infinera G42 CVSS 3.1MEDIUM 6.5
  • TI-2025-19897 Improper Access Control Granularity impacting Infinera G42 CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences