OS Command Injection in Zenitel EdgeAudioClient TFTP Provisioning Module
CVE-2026-95377

9.4CRITICAL

Key Information:

Vendor

Zenitel

Status
Vsff6
Vsff8
Vsff8mp
Vsff8mn
Vendor
CVE Published:
13 November 2026

What is CVE-2026-95377?

An OS command injection vulnerability exists in the TFTP provisioning module of the Zenitel EdgeAudioClient that allows unauthenticated adjacent attackers to execute arbitrary commands with root privileges. This occurs through a malformed DHCP option 66 value, which, when supplied by a rogue DHCP server within the same network segment, is passed unsanitized to the device's shell. This vulnerability affects devices utilizing the default DHCP configuration every time they boot or renew their lease. Additionally, the issue is accessible through configuration fields such as config_update_tftp_server and sw_update_tftp_server if an attacker modifies the device configuration.

Affected Version(s)

VSFF6 Linux 0 < 9.6.3.0

VSFF6 Linux 10.0.0.0 < 10.1.3.0

VSFF8 Linux 0 < 9.6.3.0

References

https://www.zenitel.com/sites/default/files/2026-11/A100K...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by Kevin Schaller and Dominik Schneider from Amazon Security
.