CVE-2025-27026 in G42
Summary
by MITRE • 07/02/2025
A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deactivation time. Loosing access to these services device administrators are at risk of completely loosing device control.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/11/2026
The vulnerability identified as CVE-2025-27026 represents a critical security flaw in the Infinera G42 network infrastructure device running version R6.1.3. This issue stems from a missing double-check mechanism within the WebGUI interface that governs command line interface deactivation processes. The absence of proper confirmation prompts creates a significant operational risk for network administrators who manage these critical infrastructure components. The vulnerability specifically affects the WebGUI's CLI deactivation functionality, which when triggered without proper verification, can result in the complete deactivation of multiple management interfaces simultaneously.
The technical implementation of this vulnerability manifests through the lack of user confirmation during the CLI deactivation process within the WebGUI interface. When an authenticated administrator initiates the deactivation of the command line interface, the system does not require any form of explicit confirmation before proceeding with the operation. This design flaw allows for accidental or malicious deactivation of critical management interfaces including the Linux shell, web graphical user interface, and physical serial console access. The vulnerability directly maps to CWE-665 Improper Initialization, as the system fails to properly validate or confirm critical administrative actions before executing them. The flaw also aligns with CWE-347 Improper Verification of Cryptographic Signature, since the missing confirmation mechanism represents an improper verification of the administrator's intent before executing potentially destructive operations.
The operational impact of this vulnerability extends beyond simple service interruption to represent a complete loss of device control for administrators. When the CLI deactivation process is initiated without confirmation, it simultaneously disables multiple access points to the device, creating a scenario where administrators may lose access to all management interfaces. This multi-interface deactivation creates a cascading effect that can leave the device completely inaccessible via local or network interfaces, effectively rendering the system unusable for maintenance, monitoring, or troubleshooting purposes. The vulnerability can be exploited both accidentally through user error or deliberately by malicious actors seeking to disrupt network operations or gain unauthorized control over critical infrastructure. This situation directly correlates with ATT&CK technique T1566.002 Phishing: Spearphishing Attachments, as the vulnerability could be exploited through social engineering to trick administrators into performing destructive actions without proper verification.
The security implications of CVE-2025-27026 are particularly severe given that it affects network infrastructure devices that are critical to enterprise and service provider networks. The lack of confirmation mechanisms means that any authenticated user with administrative privileges can inadvertently or intentionally cause complete loss of device management capabilities. This vulnerability creates a significant risk for organizations relying on Infinera G42 devices, as it can result in extended downtime, service disruption, and potential security breaches. The affected device configuration allows for the simultaneous disabling of multiple management interfaces, which represents a fundamental flaw in the system's access control and administrative workflow design. Organizations should consider implementing additional security controls and backup access procedures to mitigate the risk associated with this vulnerability, particularly in environments where network reliability and availability are paramount. The vulnerability also highlights the importance of proper access control validation and confirmation mechanisms in network infrastructure management interfaces, as outlined in industry best practices for secure system design and implementation.