Remote Code Execution Risk in Zenitel Communication Devices
CVE-2025-64091

8.6HIGH

Key Information:

Vendor

Zenitel

Status
Tcis-3+
Vendor
CVE Published:
9 January 2026

What is CVE-2025-64091?

An identified vulnerability in Zenitel communication devices enables authenticated attackers to execute arbitrary commands through improper handling of the Network Time Protocol (NTP) configuration. This flaw will make devices susceptible to exploitation, leading to potential security breaches if not addressed. Users are advised to review their system configurations and apply any necessary patches as indicated in the Zenitel Security Advisory.

Affected Version(s)

TCIS-3+ <9.2.3.3

References

https://www.zenitel.com/sites/default/files/2025-12/A100K...
vendor-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.