CVE-2025-64126: Zenitel TCIV-3+ OS Command Injection
An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.3.3.0 - Upgrade
Upgrade
Zenitel TCIV-3+to a version that resolves this vulnerability.Fixed in 9.3.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64126?
The severity of CVE-2025-64126 is high due to the potential for remote code execution through OS command injection.
How do I fix CVE-2025-64126?
To fix CVE-2025-64126, ensure proper input validation is implemented to verify user input as a valid IP address and filter out potentially malicious characters.
What devices are affected by CVE-2025-64126?
The devices affected by CVE-2025-64126 include Zenitel TCIV-3+ versions prior to 9.3.3.0.
Can CVE-2025-64126 be exploited remotely?
Yes, CVE-2025-64126 can be exploited remotely by an unauthenticated attacker due to the nature of the input validation flaw.
Is authentication required to exploit CVE-2025-64126?
No, authentication is not required to exploit CVE-2025-64126 as it allows unauthenticated access to the vulnerable input.