Vulnerability · Published Jul 2, 2025 · Assigned by ENISA

CVE-2025-27021Operating System Misconfiguration in Infinera G42

High 7.0

In plain English

A high-severity security flaw in G42 from Infinera. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 95.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory. Details: The output of "sudo -l" reports the presence of "devmem" command executable as super user without using a password. This command allows to read and write an arbitrary memory area of the target device, specifying an absolute address.

Affected products (as reported)

Vendor	Product	Versions
Infinera	G42	6.1.3 – before 7.1

Weakness: CWE-266 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27021 government-resource
https://euvd.enisa.europa.eu/vulnerability/CVE-2025-27021 vdb-entry