Search
Find a vulnerability
Search criteria
11 vulnerabilities
CVE-2026-95377 (GCVE-0-2026-95377)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:47 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning
Summary
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.
The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:51 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8 |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8MP |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8MN |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFT |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
Date Public
2026-11-13 15:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:51:26.769617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:09.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\u003c/p\u003e\u003cp\u003eThe same injection is also reachable via the \u003ccode\u003econfig_update_tftp_server\u003c/code\u003e and \u003ccode\u003esw_update_tftp_server\u003c/code\u003e configuration fields by an attacker able to modify the device configuration.\u003c/p\u003e"
}
],
"value": "OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\n\n\n\nThe same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:47:10.537Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment."
}
],
"value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95377",
"datePublished": "2026-11-13T15:47:10.537Z",
"dateReserved": "2026-09-22T05:16:14.448Z",
"dateUpdated": "2026-11-13T20:03:09.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95614 (GCVE-0-2026-95614)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:46 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container
Summary
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:51 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:46
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:51:38.523906Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:25.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:46:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file."
}
],
"value": "The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-15",
"description": "CWE-15 External control of system or configuration setting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653 Improper isolation or compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:46:37.152Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cspan\u003eUpgrade to version 1.11.0\u003c/span\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Upgrade to version 1.11.0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95614",
"datePublished": "2026-11-13T15:46:37.152Z",
"dateReserved": "2026-09-22T09:56:14.237Z",
"dateUpdated": "2026-11-13T20:03:25.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95615 (GCVE-0-2026-95615)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:45 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API
Summary
OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:51 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:45
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:51:50.060942Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:42.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:45:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OS command injection\u0026nbsp;vulnerability\u0026nbsp;in audio messages API in Zenitel\u0026nbsp;Connect before 1.11.0 allows remote\u0026nbsp;authenticated users\u0026nbsp;to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the\u0026nbsp;/api/system/audio_messages endpoint."
}
],
"value": "OS command injection\u00a0vulnerability\u00a0in audio messages API in Zenitel\u00a0Connect before 1.11.0 allows remote\u00a0authenticated users\u00a0to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the\u00a0/api/system/audio_messages endpoint."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:45:56.520Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cspan\u003eUpgrade to version 1.11.0\u003c/span\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Upgrade to version 1.11.0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95615",
"datePublished": "2026-11-13T15:45:56.520Z",
"dateReserved": "2026-09-22T09:56:15.657Z",
"dateUpdated": "2026-11-13T20:03:42.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95378 (GCVE-0-2026-95378)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:45 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root
Summary
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:52 UTC
CWE
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MP |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MN |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFT |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
Date Public
2026-11-13 15:45
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:52:26.219395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:58.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:45:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePath traversal in the certificate upload endpoint (\u003ccode\u003e/api/certificate/upload\u003c/code\u003e) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted \u003ccode\u003efilename\u003c/code\u003e parameter in a multipart upload request when the \u003ccode\u003etype\u003c/code\u003e field is set to any value other than \u003ccode\u003ehttps_certificate\u003c/code\u003e. In that case, both path validation and certificate content validation are skipped.\u003c/p\u003e\u003cp\u003eThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.\u003c/p\u003e"
}
],
"value": "Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-23",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-23 File Content Injection"
}
]
},
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:45:14.968Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95378",
"datePublished": "2026-11-13T15:45:14.968Z",
"dateReserved": "2026-09-22T05:16:24.841Z",
"dateUpdated": "2026-11-13T20:03:58.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95613 (GCVE-0-2026-95613)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:44 – Updated: 2026-11-13 20:04
VLAI
EPSS
VEX
Title
Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim
Summary
The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:52 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:44
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:52:39.915721Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:04:15.272Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eThe pREST database REST API in\u0026nbsp;\u003c/span\u003eZenitel Connect\u003cspan\u003e\u0026nbsp;firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the \"postgres\" superuser,\u0026nbsp;\u003c/span\u003ewhich allows local attackers who can read the platform CA private key from the container filesystem\u003cspan\u003e\u0026nbsp;to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.\u003c/span\u003e"
}
],
"value": "The pREST database REST API in\u00a0Zenitel Connect\u00a0firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the \"postgres\" superuser,\u00a0which allows local attackers who can read the platform CA private key from the container filesystem\u00a0to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653 Improper isolation or compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:44:28.709Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cspan\u003eUpgrade to version 1.11.0\u003c/span\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Upgrade to version 1.11.0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95613",
"datePublished": "2026-11-13T15:44:28.709Z",
"dateReserved": "2026-09-22T09:55:19.680Z",
"dateUpdated": "2026-11-13T20:04:15.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95379 (GCVE-0-2026-95379)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:43 – Updated: 2026-11-13 21:42
VLAI
EPSS
VEX
Title
Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root
Summary
Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:42 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MP |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MN |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFT |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
Date Public
2026-11-13 15:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:42:03.268405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:42:12.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePath traversal in the \u003ccode\u003ecertificate.deleteCertificate\u003c/code\u003e JSON-RPC method (\u003ccode\u003ePOST /api/rpc\u003c/code\u003e) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (\u003ccode\u003e../\u003c/code\u003e) in the \u003ccode\u003efile_name\u003c/code\u003e parameter.\u003c/p\u003e\u003cp\u003eThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.\u003c/p\u003e"
}
],
"value": "Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.\n\n\n\nThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:43:32.974Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95379",
"datePublished": "2026-11-13T15:43:32.974Z",
"dateReserved": "2026-09-22T05:16:26.266Z",
"dateUpdated": "2026-11-13T21:42:12.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105623 (GCVE-0-2026-105623)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:42 – Updated: 2026-11-13 21:43
VLAI
EPSS
VEX
Title
Zenitel Connect web interface serves production JavaScript source maps without authentication
Summary
The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:43 UTC
CWE
- CWE-540 - Inclusion of Sensitive Information in Source Code
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:42
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105623",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:43:27.551807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:43:33.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by ZeroSubnet"
}
],
"datePublic": "2026-11-13T15:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.\u003c/p\u003e"
}
],
"value": "The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-540",
"description": "CWE-540 Inclusion of Sensitive Information in Source Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:42:42.515Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to version 1.11.0\u003c/p\u003e"
}
],
"value": "Upgrade to version 1.11.0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect web interface serves production JavaScript source maps without authentication",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-105623",
"datePublished": "2026-11-13T15:42:42.515Z",
"dateReserved": "2026-10-05T16:31:04.052Z",
"dateUpdated": "2026-11-13T21:43:33.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105624 (GCVE-0-2026-105624)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:41 – Updated: 2026-11-13 21:45
VLAI
EPSS
VEX
Title
Zenitel Connect login allows account-lockout denial of service
Summary
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:45 UTC
CWE
- CWE-645 - Overly Restrictive Account Lockout Mechanism
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:45:12.663777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:45:18.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by ZeroSubnet"
}
],
"datePublic": "2026-11-13T15:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.\u003c/p\u003e"
}
],
"value": "The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-645",
"description": "CWE-645 Overly Restrictive Account Lockout Mechanism",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:41:59.393Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to version 1.11.0\u003c/p\u003e"
}
],
"value": "Upgrade to version 1.11.0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect login allows account-lockout denial of service",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-105624",
"datePublished": "2026-11-13T15:41:59.393Z",
"dateReserved": "2026-10-05T16:31:06.093Z",
"dateUpdated": "2026-11-13T21:45:18.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105622 (GCVE-0-2026-105622)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:40 – Updated: 2026-11-13 21:46
VLAI
EPSS
VEX
Title
Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel
Summary
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:46 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:40
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:46:14.050984Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:46:22.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by ZeroSubnet"
}
],
"datePublic": "2026-11-13T15:40:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user\u0027s secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0."
}
],
"value": "Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user\u0027s secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:40:23.944Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cspan\u003eUpgrade to version 1.11.0, which removes the WAMP-CRA authentication path\u003c/span\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Upgrade to version 1.11.0, which removes the WAMP-CRA authentication path"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-105622",
"datePublished": "2026-11-13T15:40:23.944Z",
"dateReserved": "2026-10-05T16:30:58.403Z",
"dateUpdated": "2026-11-13T21:46:22.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105625 (GCVE-0-2026-105625)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:39 – Updated: 2026-11-13 20:04
VLAI
EPSS
VEX
Title
Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction
Summary
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:52 UTC
CWE
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:38
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:52:51.251365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:04:30.941Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by ZeroSubnet"
}
],
"datePublic": "2026-11-13T15:38:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source."
}
],
"value": "The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:39:12.569Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to version 1.11.0\u003c/p\u003e"
}
],
"value": "Upgrade to version 1.11.0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-105625",
"datePublished": "2026-11-13T15:39:12.569Z",
"dateReserved": "2026-10-05T16:31:07.433Z",
"dateUpdated": "2026-11-13T20:04:30.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105671 (GCVE-0-2026-105671)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:37 – Updated: 2026-11-13 20:04
VLAI
EPSS
VEX
Title
Zenitel Connect login allows username enumeration via verbose error responses
Summary
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:53 UTC
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | Zenitel Connect |
Affected:
0 , < 1.11.0
(semver)
|
Date Public
2026-11-13 15:36
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:53:08.383290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:04:47.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenitel Connect",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Reported by ZeroSubnet"
}
],
"datePublic": "2026-11-13T15:36:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.\u003c/p\u003e"
}
],
"value": "The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204 Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:37:28.294Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to version 1.11.0\u003c/p\u003e"
}
],
"value": "Upgrade to version 1.11.0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Zenitel Connect login allows username enumeration via verbose error responses",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-105671",
"datePublished": "2026-11-13T15:37:28.294Z",
"dateReserved": "2026-10-05T17:24:32.718Z",
"dateUpdated": "2026-11-13T20:04:47.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}