CVE-2025-27022: Nokia g42 Firmware

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.

Affected products

• Nokia g42 Firmware: from 6.1.3, before 7.1 (fixed in 7.1)

Published 2025-07-02. Last modified 2026-06-17.