CVE-2026-95377

OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 TFTP Server Na...

CVE-2026-95614

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as...

CVE-2026-95615

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audiomessages endpoint...

CVE-2026-95378

Path traversal in the certificate upload endpoint /api/certificate/upload of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a...

CVE-2026-95613

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the...

CVE-2026-95379

Path traversal in the certificate.deleteCertificate JSON-RPC method POST /api/rpc of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root...

CVE-2026-105623

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...

CVE-2026-105624

The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues via repeated...

CVE-2026-105622

Improper restriction of excessive authentication attempts in the WAMP-CRA challenge-response authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the...

CVE-2026-105625

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source...

CVE-2026-105671

The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests...

CVE-2024-57784

CVE-2024-57784 Exploit Title: Authenticated Directory Traversal Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57784 usage: CVE-2024-57784.py -h -u URL -f FILE optional arguments: -h,...

CVE-2024-57785

CVE-2024-57785 Exploit Title: Authenticated File Inclusion Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57785 Usage: CVE-2024-57785.py -h -u URL -f FILE optional arguments: -h, --help...

Zenitel AlphaCom security vulnerability

Zenitel AlphaCom is a critical communication server owned by the Norwegian company Zenitel. There is a security vulnerability in Zenitel AlphaCom, which allows attackers to read arbitrary files by modifying file path parameters to internal system paths...

Zenitel TCIS-3+ security vulnerabilities

Zenitel TCIS-3+ is an IP intercom terminal produced by the Norwegian company Zenitel. There is a security vulnerability in Zenitel TCIS-3+, which allows authenticated attackers to execute arbitrary commands on the underlying system using the file names uploaded by them...

Zenitel VS-IS Arbitrary Command Execution

The vulnerability of the internal communication and emergency notification system Zenitel VS-IS is related to the failure to take measures for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Zenitel ICX500 and Zenitel ICX510 security vulnerabilities

Zenitel ICX500 and Zenitel ICX510 are both communication and control platforms from Zenitel Norway. A security vulnerability exists in the Zenitel ICX500 and Zenitel ICX510, which can be exploited by an unauthenticated attacker to inject a SQL request into a GET request parameter and directly que...

Zenitel ICX500 and Zenitel ICX510 security vulnerabilities

The Zenitel ICX500 and Zenitel ICX510 are both communication and control platforms from Zenitel Norway. A security vulnerability exists in the Zenitel ICX500 and Zenitel ICX510 that originates from an authenticated attacker being able to execute commands via the device's NTP configuration...

Zenitel ICX500 and Zenitel ICX510 security vulnerabilities

The Zenitel ICX500 and Zenitel ICX510 are both communication and control platforms from Zenitel Norway. A security vulnerability exists in the Zenitel ICX500 and Zenitel ICX510 that originates from an unauthenticated attacker being able to inject arbitrary commands into the hostname of the device...

Zenitel ICX500 and Zenitel ICX510 security vulnerabilities

The Zenitel ICX500 and Zenitel ICX510 are both communication and control platforms from Zenitel Norway. A security vulnerability exists in the Zenitel ICX500 and Zenitel ICX510 that can be exploited by an authenticated attacker to execute commands via the device hostname...