Path Traversal Vulnerability in Zenitel Devices
CVE-2026-95379

7HIGH

Key Information:

Vendor

Zenitel

Status
Vsff6
Vsff8
Vsff8mp
Vsff8mn
Vendor
CVE Published:
13 November 2026

What is CVE-2026-95379?

A path traversal vulnerability exists in the certificate.deleteCertificate JSON-RPC method of the turbineweb web interface in Zenitel devices. This flaw allows authenticated administrators to delete arbitrary files as root by manipulating the file_name parameter with relative paths. Exploiting this issue can lead to denial of service by removing essential system files, and it poses a severe risk to device security through the deletion of crucial components such as firewall rules or certificate trust stores. It is critical for administrators to ensure their devices are updated to mitigate this vulnerability.

Affected Version(s)

VSFF6 Linux 10.0.3.0 < 10.1.3.0

VSFF8 Linux 10.0.3.0 < 10.1.3.0

VSFF8MN Linux 10.0.3.0 < 10.1.3.0

References

https://www.zenitel.com/sites/default/files/2026-11/A100K...

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Reported by Kevin Schaller and Dominik Schneider from Amazon Security
.