Skip to content
OpenAdvisories
Critical ICSA-25-329-03 5 CVEs

Zenitel TCIV-3+

Published Nov 25, 2025 · Updated Nov 25, 2025

Vendor: Zenitel Product: TCIV-3+

Summary

Successful exploitation of these vulnerabilities could result in arbitrary code execution or cause a denial-of-service condition.

Vulnerabilities 5

  • Critical 10.0
    CVE-2025-64126

    Zenitel TCIV-3+ OS Command Injection

    An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthent…

    Zenitel TCIV-3+
  • Critical 10.0
    CVE-2025-64127

    Zenitel TCIV-3+ OS Command Injection

    An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to …

    Zenitel TCIV-3+
  • Critical 10.0
    CVE-2025-64128

    Zenitel TCIV-3+ OS Command Injection

    An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to i…

    Zenitel TCIV-3+
  • Critical 9.8
    CVE-2025-64130

    Zenitel TCIV-3+ Cross-site Scripting

    Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.

    Zenitel TCIV-3+
  • High 7.6
    CVE-2025-64129

    Zenitel TCIV-3+ Out-of-bounds Write

    Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device.

    Zenitel TCIV-3+

Revision history

  1. #1

    Initial Publication

References