Search
Find a vulnerability
Search criteria
6 vulnerabilities found for VSFF8MP by Zenitel
CVE-2026-95379 (GCVE-0-2026-95379)
Vulnerability from nvd – Published: 2026-11-13 15:43 – Updated: 2026-11-13 21:42
VLAI
EPSS
VEX
Title
Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root
Summary
Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:42 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MP |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MN |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFT |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
Date Public
2026-11-13 15:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:42:03.268405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:42:12.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePath traversal in the \u003ccode\u003ecertificate.deleteCertificate\u003c/code\u003e JSON-RPC method (\u003ccode\u003ePOST /api/rpc\u003c/code\u003e) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (\u003ccode\u003e../\u003c/code\u003e) in the \u003ccode\u003efile_name\u003c/code\u003e parameter.\u003c/p\u003e\u003cp\u003eThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.\u003c/p\u003e"
}
],
"value": "Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.\n\n\n\nThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:43:32.974Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95379",
"datePublished": "2026-11-13T15:43:32.974Z",
"dateReserved": "2026-09-22T05:16:26.266Z",
"dateUpdated": "2026-11-13T21:42:12.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95378 (GCVE-0-2026-95378)
Vulnerability from nvd – Published: 2026-11-13 15:45 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root
Summary
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:52 UTC
CWE
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MP |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MN |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFT |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
Date Public
2026-11-13 15:45
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:52:26.219395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:58.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:45:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePath traversal in the certificate upload endpoint (\u003ccode\u003e/api/certificate/upload\u003c/code\u003e) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted \u003ccode\u003efilename\u003c/code\u003e parameter in a multipart upload request when the \u003ccode\u003etype\u003c/code\u003e field is set to any value other than \u003ccode\u003ehttps_certificate\u003c/code\u003e. In that case, both path validation and certificate content validation are skipped.\u003c/p\u003e\u003cp\u003eThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.\u003c/p\u003e"
}
],
"value": "Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-23",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-23 File Content Injection"
}
]
},
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:45:14.968Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95378",
"datePublished": "2026-11-13T15:45:14.968Z",
"dateReserved": "2026-09-22T05:16:24.841Z",
"dateUpdated": "2026-11-13T20:03:58.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95377 (GCVE-0-2026-95377)
Vulnerability from nvd – Published: 2026-11-13 15:47 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning
Summary
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.
The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:51 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8 |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8MP |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8MN |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFT |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
Date Public
2026-11-13 15:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:51:26.769617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:09.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\u003c/p\u003e\u003cp\u003eThe same injection is also reachable via the \u003ccode\u003econfig_update_tftp_server\u003c/code\u003e and \u003ccode\u003esw_update_tftp_server\u003c/code\u003e configuration fields by an attacker able to modify the device configuration.\u003c/p\u003e"
}
],
"value": "OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\n\n\n\nThe same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:47:10.537Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment."
}
],
"value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95377",
"datePublished": "2026-11-13T15:47:10.537Z",
"dateReserved": "2026-09-22T05:16:14.448Z",
"dateUpdated": "2026-11-13T20:03:09.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95377 (GCVE-0-2026-95377)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:47 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning
Summary
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.
The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:51 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8 |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8MP |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFF8MN |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
|
| Zenitel | VSFT |
Affected:
0 , < 9.6.3.0
(custom)
Affected: 10.0.0.0 , < 10.1.3.0 (custom) |
Date Public
2026-11-13 15:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:51:26.769617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:09.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"TFTP provisioning"
],
"packageName": "EdgeAudioClient",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "9.6.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:47:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\u003c/p\u003e\u003cp\u003eThe same injection is also reachable via the \u003ccode\u003econfig_update_tftp_server\u003c/code\u003e and \u003ccode\u003esw_update_tftp_server\u003c/code\u003e configuration fields by an attacker able to modify the device configuration.\u003c/p\u003e"
}
],
"value": "OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.\n\n\n\nThe same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:47:10.537Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment."
}
],
"value": "Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95377",
"datePublished": "2026-11-13T15:47:10.537Z",
"dateReserved": "2026-09-22T05:16:14.448Z",
"dateUpdated": "2026-11-13T20:03:09.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95378 (GCVE-0-2026-95378)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:45 – Updated: 2026-11-13 20:03
VLAI
EPSS
VEX
Title
Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root
Summary
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 19:52 UTC
CWE
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MP |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MN |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFT |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
Date Public
2026-11-13 15:45
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T19:52:26.219395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:03:58.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate upload"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:45:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePath traversal in the certificate upload endpoint (\u003ccode\u003e/api/certificate/upload\u003c/code\u003e) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted \u003ccode\u003efilename\u003c/code\u003e parameter in a multipart upload request when the \u003ccode\u003etype\u003c/code\u003e field is set to any value other than \u003ccode\u003ehttps_certificate\u003c/code\u003e. In that case, both path validation and certificate content validation are skipped.\u003c/p\u003e\u003cp\u003eThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.\u003c/p\u003e"
}
],
"value": "Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-23",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-23 File Content Injection"
}
]
},
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:45:14.968Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95378",
"datePublished": "2026-11-13T15:45:14.968Z",
"dateReserved": "2026-09-22T05:16:24.841Z",
"dateUpdated": "2026-11-13T20:03:58.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95379 (GCVE-0-2026-95379)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:43 – Updated: 2026-11-13 21:42
VLAI
EPSS
VEX
Title
Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root
Summary
Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 21:42 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zenitel | VSFF6 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8 |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MP |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFF8MN |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
|
| Zenitel | VSFT |
Affected:
10.0.3.0 , < 10.1.3.0
(custom)
|
Date Public
2026-11-13 15:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T21:42:03.268405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T21:42:12.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFF6",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MP",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"64 bit"
],
"product": "VSFF8MN",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Certificate delete"
],
"packageName": "turbineweb",
"platforms": [
"Linux",
"ARM",
"32 bit"
],
"product": "VSFT",
"vendor": "Zenitel",
"versions": [
{
"lessThan": "10.1.3.0",
"status": "affected",
"version": "10.0.3.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security"
}
],
"datePublic": "2026-11-13T15:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePath traversal in the \u003ccode\u003ecertificate.deleteCertificate\u003c/code\u003e JSON-RPC method (\u003ccode\u003ePOST /api/rpc\u003c/code\u003e) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (\u003ccode\u003e../\u003c/code\u003e) in the \u003ccode\u003efile_name\u003c/code\u003e parameter.\u003c/p\u003e\u003cp\u003eThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.\u003c/p\u003e"
}
],
"value": "Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.\n\n\n\nThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
},
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/S:P",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:43:32.974Z",
"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"shortName": "Zenitel"
},
"references": [
{
"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"value": "Affected devices should upgrade to version 10.1.3.0 (and newer)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e",
"assignerShortName": "Zenitel",
"cveId": "CVE-2026-95379",
"datePublished": "2026-11-13T15:43:32.974Z",
"dateReserved": "2026-09-22T05:16:26.266Z",
"dateUpdated": "2026-11-13T21:42:12.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}