Vendor
Zenitel
28 known vulnerabilities in products by Zenitel, 0 of them actively exploited (CISA KEV).
Key figures
28
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-64128 | Zenitel TCIV-3+ OS Command Injection | 10.0 | |
| Critical | CVE-2025-64127 | Zenitel TCIV-3+ OS Command Injection | 10.0 | |
| Critical | CVE-2025-64126 | Zenitel TCIV-3+ OS Command Injection | 10.0 | |
| High | CVE-2021-40845 | Zenitel Alphacom Xe Audio Server: security vulnerability | 8.8 | |
| Critical | CVE-2025-64130 | Zenitel TCIV-3+ Cross-site Scripting | 9.8 | |
| Critical | CVE-2025-64093 | Unauthenticated Remote Code Execution via the device hostname | 10.0 | |
| Critical | CVE-2025-59818 | Authenticated Remote Code Execution via the file name of an uploaded file | 10.0 | |
| Critical | CVE-2026-95377 | OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning | — | |
| Critical | CVE-2026-95614 | Zenitel Connect: External Control of System or Configuration Setting | — | |
| Critical | CVE-2025-64090 | Authenticated Remote Code Execution in device hostname | 10.0 | |
| High | CVE-2026-95615 | Zenitel Connect: OS Command Injection | — | |
| High | CVE-2026-95378 | Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root | — | |
| High | CVE-2026-95613 | Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim | — | |
| High | CVE-2026-95379 | Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root | — | |
| Medium | CVE-2026-105623 | Zenitel Connect web interface serves production JavaScript source maps without authentication | — | |
| Medium | CVE-2026-105624 | Zenitel Connect login allows account-lockout denial of service | — | |
| Medium | CVE-2026-105671 | Zenitel Connect login allows username enumeration via verbose error responses | — | |
| High | CVE-2025-64091 | Authenticated Remote Code Execution in the NTP-configuration | 8.6 | |
| High | CVE-2025-64129 | Zenitel TCIV-3+ Out-of-bounds Write | 7.6 | |
| Medium | CVE-2026-105622 | Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel | — | |
| High | CVE-2025-64092 | Unauthenticated SQL injection via GET request parameters | 7.5 | |
| High | CVE-2025-59814 | Unauthenticated SQL-injection in password field | 8.8 | |
| High | CVE-2025-59815 | Authenticated Remote Code Execution in the Billing Administration portal | 8.4 | |
| Medium | CVE-2026-105625 | Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction | — | |
| High | CVE-2025-59817 | Authenticated Remote Code Execution in zForm_auto_config | 8.4 |
Products
| Zenitel Connect | 8 | 0 |
| Zenitel ICX500 | 5 | 0 |
| Zenitel ICX510 | 5 | 0 |
| Zenitel TCIV-3+ | 5 | 0 |
| Zenitel TCIS-3+ | 4 | 0 |
| Tcis-3 Firmware | 3 | 0 |
| Vsff6 | 3 | 0 |
| Vsff8 | 3 | 0 |
| Vsff8mn | 3 | 0 |
| Vsff8mp | 3 | 0 |
| Vsft | 3 | 0 |