CVE-2026-95377 is a critical OS command injection vulnerability in the TFTP provisioning module of Zenitel EdgeAudioClient on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices. It affects versions before 9.6.3.0 and 10.x before 10.1.3.0. An unauthenticated attacker on the same network segment can exploit this by supplying a crafted DHCP option 66 value, which is passed unsanitized to a shell, allowing arbitrary command execution as root. The vulnerability also exists via configuration fields if an attacker can modify device configuration. Devices using DHCP by default are affected on every boot and lease renewal. The issue is fixed in versions 9.6.3.0 and 10.1.3.0.
CVE-2026-95614 is a critical vulnerability in Zenitel Connect versions prior to 1.11.0. It involves the host configuration watcher applying a rsyslog configuration file from a data volume shared with the hiatus application container. This allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host via a crafted rsyslog configuration file. The issue is fixed in version 1.11.0.
CVE-2026-95615 is an OS command injection vulnerability in the audio messages API of Zenitel Connect versions before 1.11.0. It allows remote authenticated users to execute arbitrary operating system commands with root privileges within the hiatus application container by exploiting the filename parameter in the /api/system/audio_messages endpoint. This vulnerability has a high severity score of 8.7 and was fixed in version 1.11.0.
CVE-2026-95378 is a path traversal vulnerability in the certificate upload endpoint of Zenitel VSFF devices (VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT) running software versions from 10.0.3.0 up to but not including 10.1.3.0. Authenticated administrators can exploit this flaw by submitting a crafted filename parameter in a multipart upload request with the type field set to any value other than https_certificate, bypassing path and certificate content validation. This allows arbitrary file writes as root, which can lead to arbitrary code execution by overwriting startup scripts or planting SSH keys. The vulnerability has a high severity score of 8.6 and is fixed in version 10.1.3.0.
CVE-2026-95613 is a high-severity vulnerability in Zenitel Connect firmware versions before 1.11.0. The pREST database REST API improperly uses the platform CA private key to sign and verify JWTs and sets the PostgreSQL session role from an unvalidated JWT claim. This allows local attackers with access to the platform CA private key on the container filesystem to forge JWTs that execute database operations as the PostgreSQL superuser, including reading sensitive data such as the master encryption key and password hashes. The issue is fixed in version 1.11.0.
CVE-2026-95379 is a high-severity relative path traversal vulnerability in Zenitel VSFF devices (VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT) with software versions from 10.0.3.0 up to but not including 10.1.3.0. It affects the certificate.deleteCertificate JSON-RPC method in the turbineweb web interface, allowing authenticated administrators to delete arbitrary files as root by exploiting a relative path (../) in the file_name parameter. This can lead to denial of service or device inoperability by removing critical system files, and can weaken device security by deleting files such as firewall rules or certificate trust stores. The issue is fixed in version 10.1.3.0.
Zenitel Connect versions before 1.11.0 expose production JavaScript source maps via the web interface without requiring authentication. This exposure allows remote attackers to access the complete front-end source code, revealing API usage and internal client logic. The vulnerability is fixed in version 1.11.0.
CVE-2026-105624 is a vulnerability in Zenitel Connect versions before 1.11.0 where the login flow applies a per-account lockout after repeated failed login attempts. This lockout can be triggered remotely by attackers using known or guessed usernames, causing a denial of service by temporarily locking targeted user accounts from accessing the web interface. The issue does not affect intercom call handling. The vulnerability is fixed in version 1.11.0.
CVE-2026-105622 is a vulnerability in Zenitel Connect before version 1.11.0 where the WAMP-CRA authentication mechanism does not restrict excessive authentication attempts. This allows remote attackers to perform unlimited password guessing attempts without account lockout or rate limiting. The vulnerability is mitigated by a strong password policy requiring at least 12 characters with mixed character types. The vulnerable authentication path was removed in version 1.11.0.
Zenitel Connect versions before 1.11.0 have a vulnerability where the web interface loads an integration iframe without sandboxing or origin restrictions. This flaw allows remote attackers to present phishing content to authenticated users by crafting a malicious frame source. The issue is fixed in version 1.11.0.
A vulnerability in Zenitel Connect versions before 1.11.0 allows remote attackers to enumerate valid usernames by observing different error responses during the login process. This issue is due to an observable response discrepancy that reveals whether a submitted username exists.
CVE-2025-59818 is a critical remote code execution vulnerability in Zenitel TCIS-3+ versions prior to 9.2.3.3. It allows unauthenticated attackers to execute arbitrary commands on the underlying system by exploiting improper handling of uploaded file names. The vulnerability has a CVSS score of 10.0, indicating maximum severity with full impact on confidentiality, integrity, and availability. No public exploits are currently known, but the ease of exploitation and severity make this a significant threat. European organizations using Zenitel TCIS-3+ should urgently apply patches once available and implement strict file upload controls. Countries with critical infrastructure and high adoption of Zenitel products, such as Germany, France, and the Netherlands, are most at risk.
CVE-2025-64130 is a critical reflected cross-site scripting (XSS) vulnerability affecting the Zenitel TCIV-3+ intercom system. This flaw allows remote attackers to execute arbitrary JavaScript code in the context of a victim's browser without requiring authentication or user interaction. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability. Although no known exploits are currently in the wild, successful exploitation could lead to session hijacking, credential theft, or further network compromise. European organizations using Zenitel TCIV-3+ devices, especially in critical infrastructure or public safety sectors, are at significant risk. Mitigation requires immediate deployment of vendor patches once available and implementing web application firewalls with XSS filtering. Countries with high adoption of Zenitel products and strategic critical infrastructure, such as Germany, France, and the Netherlands, are most likely to be affected. Defenders should prioritize monitoring for suspicious web traffic and restrict access to device management interfaces to trusted networks.
CVE-2025-64129 is a high-severity out-of-bounds write vulnerability (CWE-787) affecting the Zenitel TCIV-3+ intercom device. This flaw allows a remote attacker to cause a denial-of-service by crashing the device without requiring authentication, though user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability, with the most significant effect being availability due to device crashes. No known exploits are currently reported in the wild, and no patches have been released yet. European organizations using Zenitel TCIV-3+ devices, especially in critical infrastructure or industrial environments, could face operational disruptions. Mitigation should focus on network segmentation, restricting remote access, monitoring device behavior, and preparing for vendor patches. Countries with higher adoption of Zenitel products and critical infrastructure reliance on such intercom systems, such as Germany, France, the UK, and the Netherlands, are more likely to be affected. Given the ease of remote exploitation and impact on availability, this vulnerability is rated as high severity.
CVE-2025-64128 is a critical OS command injection vulnerability in the Zenitel TCIV-3+ intercom system. It arises from insufficient validation of user input, allowing unauthenticated attackers to inject arbitrary OS commands. The vulnerability has a maximum CVSS score of 10.0, indicating it can fully compromise confidentiality, integrity, and availability without requiring authentication or user interaction. No known public exploits exist yet. This flaw could enable attackers to take full control of affected devices, disrupt communications, or pivot into internal networks. European organizations using Zenitel TCIV-3+ devices, especially in critical infrastructure or public safety sectors, face significant risk. Immediate mitigation involves isolating affected devices, applying vendor patches once available, and implementing strict network segmentation and input filtering. Countries with high deployments of Zenitel products and critical infrastructure reliance, such as Germany, France, and the UK, are most likely to be targeted.
