CVE-2026-95613

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the...

CVE-2026-95614

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as...

CVE-2026-95615

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audiomessages endpoint...

CVE-2026-105624

The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues via repeated...

CVE-2026-105625

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source...

CVE-2026-105671

The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests...

CVE-2026-105623

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...

CVE-2026-105622

Improper restriction of excessive authentication attempts in the WAMP-CRA challenge-response authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the...

CVE-2026-95614

The Zenitel Connect software (versions before 1.11.0 ) contains a vulnerability where the host configuration watcher applies an rsyslog configuration file from a data volume shared with the hiatus application container. A local attacker with write access to the hiatus container filesystem can exp...

CVE-2026-95614 Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as...

EUVD-2026-125527

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as...

CVE-2026-95615

Zenitel Connect versions before 1.11.0 are vulnerable to an OS command injection vulnerability within the audio messages API. This flaw exists in the /api/system/audio_messages endpoint due to the improper neutralization of special elements in the filename parameter. A remote authenticated user c...

EUVD-2026-125525

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audiomessages endpoint...

CVE-2026-95615 Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audiomessages endpoint...

CVE-2026-95613 Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the...

CVE-2026-95613

The pREST database REST API in Zenitel Connect firmware before version 1.11.0 is vulnerable to unauthorized privilege escalation. The application uses a platform CA private key—accessible on a shared data volume—to sign and verify JWTs. It incorrectly sets the PostgreSQL session role based on an ...

EUVD-2026-125523

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the...

CVE-2026-105623 Zenitel Connect web interface serves production JavaScript source maps without authentication

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...

CVE-2026-105623

The web interface in Zenitel Connect (versions before 1.11.0) is vulnerable to an information disclosure flaw because it serves production JavaScript source maps without authentication. A remote attacker can request these source map files to obtain the complete front-end source code, exposing API...

EUVD-2026-125457

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...