CVE-2025-27021

Katalog CVE

CVSS 7.8 · High EPSS 0,16%

Kerentanan Incorrect Privilege Assignment pada nokia g42 firmware. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory. Details: The output of "sudo -l" reports the presence of "devmem" command executable as super user without using a password. This command allows to read and write an arbitrary memory area of the target device, specifying an absolute address.

Rincian

Terbit di NVD

2 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27021 advisory pihak ketiga
• https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27021 advisory pihak ketiga