Zenitel Connect vulnerabilities
3 known vulnerabilities in Zenitel Connect from Zenitel. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
Zenitel Connect: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages en
- 9.3 Critical severity
Zenitel Connect: External Control of System or Configuration Setting
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesyste
- 8.6 High severity
Zenitel Connect: Execution with Unnecessary Privileges
The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of e