# cve.now: Zenitel

The newest entries naming Zenitel as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-95377](https://cve.now/CVE-2026-95377.md): OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning (CVSS 9.4)
- [CVE-2026-95614](https://cve.now/CVE-2026-95614.md): Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container (CVSS 9.3)
- [CVE-2026-95615](https://cve.now/CVE-2026-95615.md): Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API (CVSS 8.7)
- [CVE-2026-95378](https://cve.now/CVE-2026-95378.md): Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root (CVSS 8.6)
- [CVE-2026-95613](https://cve.now/CVE-2026-95613.md): Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim (CVSS 8.6)
- [CVE-2026-95379](https://cve.now/CVE-2026-95379.md): Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root (CVSS 7.0)
- [CVE-2026-105623](https://cve.now/CVE-2026-105623.md): Zenitel Connect web interface serves production JavaScript source maps without authentication (CVSS 6.9)
- [CVE-2026-105624](https://cve.now/CVE-2026-105624.md): Zenitel Connect login allows account-lockout denial of service (CVSS 6.9)
- [CVE-2026-105622](https://cve.now/CVE-2026-105622.md): Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel (CVSS 6.3)
- [CVE-2026-105625](https://cve.now/CVE-2026-105625.md): Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction (CVSS 5.1)
- [CVE-2026-105671](https://cve.now/CVE-2026-105671.md): Zenitel Connect login allows username enumeration via verbose error responses (CVSS 6.9)
- [CVE-2025-59819](https://cve.now/CVE-2025-59819.md): Authenticated Arbitrary File Read via filepath parameter (CVSS 6.5)
- [CVE-2025-59818](https://cve.now/CVE-2025-59818.md): Authenticated Remote Code Execution via the file name of an uploaded file (CVSS 10.0)
- [CVE-2025-64093](https://cve.now/CVE-2025-64093.md): Unauthenticated Remote Code Execution via the device hostname (CVSS 10.0)
- [CVE-2025-64092](https://cve.now/CVE-2025-64092.md): Unauthenticated SQL injection via GET request parameters (CVSS 7.5)
- [CVE-2025-64091](https://cve.now/CVE-2025-64091.md): Authenticated Remote Code Execution in the NTP-configuration (CVSS 8.6)
- [CVE-2025-64090](https://cve.now/CVE-2025-64090.md): Authenticated Remote Code Execution in device hostname (CVSS 10.0)
- [CVE-2025-64130](https://cve.now/CVE-2025-64130.md): Zenitel TCIV-3+ Cross-site Scripting (CVSS 9.8)
- [CVE-2025-64129](https://cve.now/CVE-2025-64129.md): Zenitel TCIV-3+ Out-of-bounds Write (CVSS 7.6)
- [CVE-2025-64128](https://cve.now/CVE-2025-64128.md): Zenitel TCIV-3+ OS Command Injection (CVSS 10.0)
- [CVE-2025-64127](https://cve.now/CVE-2025-64127.md): Zenitel TCIV-3+ OS Command Injection (CVSS 10.0)
- [CVE-2025-64126](https://cve.now/CVE-2025-64126.md): Zenitel TCIV-3+ OS Command Injection (CVSS 10.0)
- [CVE-2025-59817](https://cve.now/CVE-2025-59817.md): Authenticated Remote Code Execution in zForm\_auto\_config (CVSS 8.4)
- [CVE-2025-59816](https://cve.now/CVE-2025-59816.md): Authenticated Union based SQL-injection in the search input field (CVSS 7.3)
- [CVE-2025-59815](https://cve.now/CVE-2025-59815.md): Authenticated Remote Code Execution in the Billing Administration portal (CVSS 8.4)
- [CVE-2025-59814](https://cve.now/CVE-2025-59814.md): Unauthenticated SQL-injection in password field (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zenitel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.