Threats tagged 'ghsa-83vh-fr57-2jq8'

A path traversal vulnerability exists in the certificate.deleteCertificate JSON-RPC method of the turbineweb web interface in certain Zenitel devices. Authenticated administrators can exploit this flaw by providing a relative path in the file_name parameter to delete arbitrary files as root. This can lead to denial of service or device inoperability by removing critical system files, including security-related files such as firewall rules or certificate trust stores.