CVE-2025-64092: Unauthenticated SQL injection via GET request parameters
Published Jan 9, 2026
·Updated
This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.
Affected Software
4 affected components
All of the following
Zenitel Icx500 Firmware<1.4.3.3
Zenitel ICX500
All of the following
Zenitel Icx510 Firmware<1.4.3.3
Zenitel ICX510
Event History
Jan 9, 2026
CVE Published
via MITRE·10:03 AM
Data Sourced
via MITRE·10:03 AM
DescriptionSeverity
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-64092?
CVE-2025-64092 is considered a high severity vulnerability due to its potential for unauthenticated SQL injection.
2
How do I fix CVE-2025-64092?
To fix CVE-2025-64092, update Zenitel ICX500 and ICX510 firmware to a version newer than 1.4.3.3.
3
Who is affected by CVE-2025-64092?
Users of Zenitel ICX500 and ICX510 running firmware versions up to 1.4.3.3 are affected by CVE-2025-64092.
4
What type of attack exploits CVE-2025-64092?
CVE-2025-64092 is exploited through unauthenticated SQL injection via GET request parameters.
5
What could an attacker do with CVE-2025-64092?
An attacker could potentially query the underlying database and extract sensitive information due to CVE-2025-64092.