OS Command Injection Vulnerability in Zenitel Communication Devices
CVE-2025-64126

10CRITICAL

Key Information:

Vendor

Zenitel

Status
Tciv-3+
Vendor
CVE Published:
26 November 2025

What is CVE-2025-64126?

An OS command injection vulnerability has been identified in Zenitel's Station and Device Firmware Package (VS-IS), caused by improper input validation. The application processes user-supplied parameters without adequate checks to confirm valid IP addresses or eliminate potentially harmful characters. This flaw could enable an unauthenticated attacker to inject and execute arbitrary commands within the system, posing significant security risks.

Affected Version(s)

TCIV-3+ 0 <= 9.3.3.0

References

https://wiki.zenitel.com/wiki/Downloads#Station_and_Devic...
https://www.cisa.gov/news-events/ics-advisories/icsa-25-3...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Tepper and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA.
.