CVE-2025-27024

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Improper Handling of Insufficient Permissions or Privileges pada nokia g42 firmware. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used for SSH CLI access and are able to read all files according to the OS permission instead of remaining inside the chrooted directory position.

Rincian

Terbit di NVD

2 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-280: Improper Handling of Insufficient Permissions or Privileges

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27024 advisory pihak ketiga
• https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27024 advisory pihak ketiga