Zenitel CVEs
26 CVEs and advisories name Zenitel as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-95377OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning
- CVE-2026-95614Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container
- CVE-2026-95615Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API
- CVE-2026-95378Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root
- CVE-2026-95613Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim
- CVE-2026-95379Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root
- CVE-2026-105623Zenitel Connect web interface serves production JavaScript source maps without authentication
- CVE-2026-105624Zenitel Connect login allows account-lockout denial of service
- CVE-2026-105622Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel
- CVE-2026-105625Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction
- CVE-2026-105671Zenitel Connect login allows username enumeration via verbose error responses
- CVE-2025-59819Authenticated Arbitrary File Read via filepath parameter
- CVE-2025-59818Authenticated Remote Code Execution via the file name of an uploaded file
- CVE-2025-64093Unauthenticated Remote Code Execution via the device hostname
- CVE-2025-64092Unauthenticated SQL injection via GET request parameters
- CVE-2025-64091Authenticated Remote Code Execution in the NTP-configuration
- CVE-2025-64090Authenticated Remote Code Execution in device hostname
- CVE-2025-64130Zenitel TCIV-3+ Cross-site Scripting
- CVE-2025-64129Zenitel TCIV-3+ Out-of-bounds Write
- CVE-2025-64128Zenitel TCIV-3+ OS Command Injection
- CVE-2025-64127Zenitel TCIV-3+ OS Command Injection
- CVE-2025-64126Zenitel TCIV-3+ OS Command Injection
- CVE-2025-59817Authenticated Remote Code Execution in zForm_auto_config
- CVE-2025-59816Authenticated Union based SQL-injection in the search input field
- CVE-2025-59815Authenticated Remote Code Execution in the Billing Administration portal
- CVE-2025-59814Unauthenticated SQL-injection in password field