OS Command Injection Vulnerability in Zenitel Communication Systems
CVE-2025-64128

10CRITICAL

Key Information:

Vendor

Zenitel

Status
Tciv-3+
Vendor
CVE Published:
26 November 2025

What is CVE-2025-64128?

An OS command injection vulnerability in Zenitel's communication systems is caused by inadequate validation of user-supplied input. This vulnerability allows attackers to exploit improper formatting rules, potentially enabling unauthorized commands to be executed on the system. An unauthenticated user may be able to append arbitrary data, leading to significant security risks if not promptly addressed.

Affected Version(s)

TCIV-3+ 0 <= 9.3.3.0

References

https://wiki.zenitel.com/wiki/Downloads#Station_and_Devic...
https://www.cisa.gov/news-events/ics-advisories/icsa-25-3...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Tepper and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA.
.