CVE-2025-27019

Technical Details

This vulnerability stems from the insecure configuration of the Remote Shell service (RSH) within the Infinera MTC-9 firmware. Specifically, the system permits the creation and use of user accounts that do not require a password for authentication. An attacker can exploit this by initiating an RSH connection using one of these password-less accounts. Upon successful authentication (or lack thereof), the attacker can then execute commands on the system, including the activation of a reverse shell. A reverse shell allows the attacker to establish a connection from the compromised system back to a listening attacker-controlled machine, granting them full interactive shell access. The combination of password-less accounts and the ability to execute arbitrary commands via RSH results in a highly exploitable vulnerability.

The vulnerability exists because the RSH service does not properly enforce authentication requirements, allowing connections from accounts without passwords. This bypasses standard security measures and provides a direct pathway for unauthorized access. The ability to then initiate a reverse shell further exacerbates the issue, as it provides persistent and interactive control over the affected system.