CVE-2025-27024

published 2025-07-02

CVE-2025-27024: Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP…

Priority P3 41 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

Unrestricted access to OS file system in SFTP service in Infinera G42
version R6.1.3 allows remote authenticated users to read/write OS files
via SFTP connections.

Details: Account members of the Network Administrator profile can access the
target machine via SFTP with the same credentials used for SSH CLI
access and are able to read all files according to the OS permission instead of remaining inside the chrooted directory position.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
infinera	g42	>= 6.1.3 < 8.0	8.0
nokia	g42_firmware	>= 6.1.3 < 8.0	8.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-280