Zenitel Tciv-3 vulnerabilities

CVE-2025-64127 [CRITICAL] CWE-78 CVE-2025-64127: An OS command injection vulnerability exists due to insufficient sanitization of user-supplied inpu An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely.

CVE-2025-64126 [CRITICAL] CWE-78 CVE-2025-64126: An OS command injection vulnerability exists due to improper input validation. The application acce An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary commands.

CVE-2025-64128 [CRITICAL] CWE-78 CVE-2025-64128: An OS command injection vulnerability exists due to incomplete validation of user-supplied input. V An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands.

CVE-2025-64130 [CRITICAL] CWE-79 CVE-2025-64130: Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.

CVE-2025-64129 [HIGH] CWE-787 CVE-2025-64129: Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote a Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device.