Infinera vulnerabilities
We track 12 vulnerabilities in Infinera products across 4 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on December 8, 2025.
Latest Infinera vulnerabilities
- 9.8 Critical severity
MTC-9: Missing Authentication for Critical Functionality
Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.
- 9.8 Critical severity
MTC-9: Missing Authentication for Critical Functionality
Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
- 7.5 High severity
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users…
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R2
- 8.6 High severity
MTC-9: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.
- 8.8 High severity
G42: Improper Handling of Insufficient Permissions or Privileges
The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device f
- 7.8 High severity
G42: Incorrect Privilege Assignment
The misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of ser
- 9.0 Critical severity
tnms: Incorrect Privilege Assignment
The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges.
- 7.2 High severity
tnms: Improper Limitation of a Pathname to a Restricted Directory
In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory.
- 7.7 High severity
tnms: Cleartext Storage of Sensitive Information
In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS administrators to obtain various users' passwords by reading memory dumps of the desktop
- 8.4 High severity
hit_7300: Improper Privilege Management
An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote SSH access to the appliance via an unexpected network interface.
- 8.8 High severity
hit_7300: Use of Hard-coded Credentials
An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded credentials allows attackers to access the appliance operating system (with highest privileges) via an SSH connection.
- 8.8 High severity
hit_7300: Cleartext Storage of Sensitive Information
An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various appliance services via hardcoded credentials.