CVE-2026-95378

Path traversal in the certificate upload endpoint /api/certificate/upload of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a...

EUVD-2026-125524

Path traversal in the certificate upload endpoint /api/certificate/upload of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a...

CVE-2026-95378 Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root

Path traversal in the certificate upload endpoint /api/certificate/upload of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a...

CVE-2026-95378

A path traversal vulnerability exists in the turbineweb web interface certificate upload endpoint (/api/certificate/upload) of Zenitel devices, specifically models VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT running software versions 10.0.3.0 before 10.1.3.0 . The flaw allows authenticated administr...

EUVD-2026-125522

Path traversal in the certificate.deleteCertificate JSON-RPC method POST /api/rpc of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root...

CVE-2026-95379

The turbineweb web interface in Zenitel devices (VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT ) is vulnerable to a path traversal flaw in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc). This vulnerability exists in software versions 10.0.3.0 before 10.1.3.0 . An authenticated admin...