CVE-2025-27020
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on the file system. This issue affects MTC-9 from R22.1.1.0275 before R23.0.
Risk Assessment
An unauthenticated attacker can gain control of the device, execute commands, and access sensitive data, potentially leading to full system compromise.
Recommendation
Update Infinera MTC-9 to version R23.0 or later. Additionally, review and fix the SSH service configuration to prevent unauthorized access.
Other vulnerabilities in Infinera MTC-9
See all- CVE-2025-27019Critical
Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell. This issue affects MTC-9 from R22.1.1.0275 before R23.0.
- CVE-2025-26489Medium
Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance via crafted XML payloads, causing a DoS condition. This issue affects MTC-9 from R22.1.1.0275 before R23.0.
- CVE-2025-26488High
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance via crafted XML payloads, resulting in a DoS condition. This issue affects MTC-9 from R22.1.1.0275 before R23.0.
- CVE-2025-26487High
Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.
Original NVD description (English source)
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS