Skip to content
OpenAdvisories

Vendor

Zenitel

26 known vulnerabilities.

Products

Zenitel Connect 8 TCIV-3+ 5 ICX500 5 ICX510 5 TCIS-3+ 4 VSFF6 3 VSFF8 3 VSFF8MP 3 VSFF8MN 3 VSFT 3 alphacom_xe_audio_server 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-95377

    OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning

    OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a…

    Zenitel VSFF6 VSFF8MP VSFT
  • Critical 9.3
    CVE-2026-95614

    Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container

    The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesyst…

    Zenitel Zenitel Connect
  • Critical 10.0
    CVE-2025-59818

    Authenticated Remote Code Execution via the file name of an uploaded file

    This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.

    Zenitel TCIS-3+
  • Critical 10.0
    CVE-2025-64093

    Unauthenticated Remote Code Execution via the device hostname

    Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device.

    Zenitel ICX510 ICX500
  • Critical 10.0
    CVE-2025-64090

    Authenticated Remote Code Execution in device hostname

    This vulnerability allows authenticated attackers to execute commands via the hostname of the device.

    Zenitel TCIS-3+
  • Critical 9.8
    CVE-2025-64130

    Zenitel TCIV-3+ Cross-site Scripting

    Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.

    Zenitel TCIV-3+
  • Critical 10.0
    CVE-2025-64128

    Zenitel TCIV-3+ OS Command Injection

    An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to i…

    Zenitel TCIV-3+
  • Critical 10.0
    CVE-2025-64127

    Zenitel TCIV-3+ OS Command Injection

    An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to …

    Zenitel TCIV-3+
  • Critical 10.0
    CVE-2025-64126

    Zenitel TCIV-3+ OS Command Injection

    An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthent…

    Zenitel TCIV-3+