OS Command Injection Vulnerability in Zenitel Communication Devices
CVE-2025-64126

10CRITICAL

Key Information:

Vendor

Zenitel

Status
Tciv-3+
Vendor
CVE Published:
26 November 2025

What is CVE-2025-64126?

An OS command injection vulnerability has been identified in Zenitel's Station and Device Firmware Package (VS-IS), caused by improper input validation. The application processes user-supplied parameters without adequate checks to confirm valid IP addresses or eliminate potentially harmful characters. This flaw could enable an unauthenticated attacker to inject and execute arbitrary commands within the system, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

TCIV-3+ 0 <= 9.3.3.0

References

https://wiki.zenitel.com/wiki/Downloads#Station_and_Devic...
https://www.cisa.gov/news-events/ics-advisories/icsa-25-3...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Tepper and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA.
JSON
.