What is the CVSS score of CVE-2025-27022?

CVE-2025-27022 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of G42 Firmware are affected by CVE-2025-27022?

Infinera G42 R6.1.3 contains a path traversal vulnerability in its WebGUI that permits authenticated users to download arbitrary operating system files, potentially exposing sensitive configuration…. A patch is available.

How to fix or mitigate CVE-2025-27022?

Within 24 hours: Identify all Infinera G42 devices running R6.1.3 in your environment and document their network locations and operational criticality. Within 7 days: Contact Infinera for the patched release version and test the update in a non-production environment to ensure operational compatibility. Within 30 days: Deploy the vendor-released patch to all affected G42 R6.1.3 systems and verify successful remediation by confirming the updated firmware version.

G42 Firmware CVE-2025-27022

EUVD-2025-19697 HIGH

Path Traversal (CWE-22)

2025-07-02 a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

Path Traversal G42 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:35 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

7.1

EUVD ID Assigned

Mar 16, 2026 - 01:55 euvd

EUVD-2025-19697

Analysis Generated

Mar 16, 2026 - 01:55 vuln.today

CVE Published

Jul 02, 2025 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests.

Details:

Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.

Analysis

A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests.

Details: