Threats tagged 'ghsa-4hjx-4cg8-m339'

A path traversal vulnerability exists in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in certain Zenitel devices running software versions from 10.0.3.0 up to but not including 10.1.3.0. Authenticated administrators can exploit this flaw by providing a crafted filename parameter with the type field set to any value other than https_certificate, bypassing path and certificate content validation. This allows arbitrary file write as root, which can lead to root-level arbitrary code execution by overwriting startup scripts or planting SSH keys.