Unrestricted File System Access in Infinera G42 SFTP Service

CVE-2025-27024

What is CVE-2025-27024?

The Infinera G42, specifically version R6.1.3, presents a vulnerability in its SFTP service that permits remote authenticated users to bypass restrictions and gain unauthorized read/write access to the OS file system. Users with the Network Administrator profile can log in via SFTP using the same credentials as their SSH CLI access, allowing them to navigate outside their designated chrooted directory and interact with system-level files in accordance with the OS’s existing permission settings. This flaw exposes sensitive data and potentially allows further exploitation of the system.

References