Read the docs
TI-2025-39579 Aliases CVE-2025-64128GHSA-hhwp-x975-8r4g

Zenitel TCIV-3+ OS Command Injection

Priority MEDIUM 53CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02322 83rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZenitelTCIV-3+up to 9.3.3.0—No fix listedCNA
  • TCIV-3+ VendorZenitel Affected up to 9.3.3.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64128
  2. 2026-10-03 Alias added: GHSA-hhwp-x975-8r4g

References

Other 3

  • TI-2025-39578 Zenitel TCIV-3+ OS Command Injection CVSS 4.0CRITICAL 10.0
  • TI-2025-39577 Zenitel TCIV-3+ OS Command Injection CVSS 4.0CRITICAL 10.0
  • TI-2025-39581 Zenitel TCIV-3+ Cross-site Scripting CVSS 4.0CRITICAL 9.3
  • TI-2025-39544 Unauthenticated Remote Code Execution via the device hostname CVSS 3.1CRITICAL 10.0
  • TI-2025-37257 Authenticated Remote Code Execution via the file name of an uploaded file CVSS 3.1CRITICAL 10.0
  • TI-2025-39541 Authenticated Remote Code Execution in device hostname CVSS 3.1CRITICAL 10.0
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences