OS Command Injection Vulnerability in Zenitel Communication Systems
CVE-2025-64128

10CRITICAL

Key Information:

Vendor

Zenitel

Status
Tciv-3+
Vendor
CVE Published:
26 November 2025

What is CVE-2025-64128?

An OS command injection vulnerability in Zenitel's communication systems is caused by inadequate validation of user-supplied input. This vulnerability allows attackers to exploit improper formatting rules, potentially enabling unauthorized commands to be executed on the system. An unauthenticated user may be able to append arbitrary data, leading to significant security risks if not promptly addressed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

TCIV-3+ 0 <= 9.3.3.0

References

https://wiki.zenitel.com/wiki/Downloads#Station_and_Devic...
https://www.cisa.gov/news-events/ics-advisories/icsa-25-3...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nir Tepper and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA.
JSON
.