CVE-2025-27022
High
Description
A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNokia G42 Firmware
PublishedJul 2, 2025
First seenJul 2, 2025
Weakness typeCWE-22Path traversal
How to fix
Update
- nokia g42_firmware7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nokia g42_firmware | 6.1.3 ≤ v < 7.1 | 7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.