OS Command Injection Vulnerability in Zenitel Firmware Products
CVE-2025-64127

10CRITICAL

Key Information:

Vendor

Zenitel

Status
Tciv-3+
Vendor
CVE Published:
26 November 2025

What is CVE-2025-64127?

An OS command injection vulnerability has been identified in Zenitel's firmware products. This issue arises from inadequate sanitization of user input, allowing an attacker to incorporate parameters into operating system commands without sufficient validation. Such a flaw could enable unauthenticated users to execute arbitrary commands remotely, significantly compromising the security of the affected devices.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

TCIV-3+ 0 <= 9.3.3.0

References

https://wiki.zenitel.com/wiki/Downloads#Station_and_Devic...
https://www.cisa.gov/news-events/ics-advisories/icsa-25-3...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Tepper and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA.
JSON
.