Zenitel vulnerabilities
We track 14 vulnerabilities in Zenitel products across 10 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Zenitel vulnerabilities
- 8.7 High severity
Zenitel Connect: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages en
- 9.3 Critical severity
Zenitel Connect: External Control of System or Configuration Setting
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesyste
- 8.6 High severity
Zenitel Connect: Execution with Unnecessary Privileges
The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of e
- 7.0 High severity
VSFF6: Relative Path Traversal
Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administra
- 8.6 High severity
VSFF6: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to
- 9.4 Critical severity
VSFF6: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a
- 9.8 Critical severity
TCIV-3+: Improper Neutralization of Input During Web Page Generation
Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.
- 10.0 Critical severity
TCIV-3+: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to in
- 10.0 Critical severity
TCIV-3+: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to e
- 10.0 Critical severity
TCIV-3+: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenti
- 8.4 High severity
TCIS-3+: Improper Neutralization of Special Elements used in a Command
This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, confidentialit
- 7.3 High severity
ICX500: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of th
- 8.4 High severity
ICX500: Improper Neutralization of Special Elements used in a Command
This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity.
- 8.8 High severity
ICX500: Improper Neutralization of Special Elements used in an SQL Command
This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database.