CVE-2025-64126: Zenitel TCIV-3+ OS Command Injection
An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary commands.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64126?
The severity of CVE-2025-64126 is high due to the potential for remote code execution through OS command injection.
How do I fix CVE-2025-64126?
To fix CVE-2025-64126, ensure proper input validation is implemented to verify user input as a valid IP address and filter out potentially malicious characters.
What devices are affected by CVE-2025-64126?
The devices affected by CVE-2025-64126 include Zenitel TCIV-3+ versions prior to 9.3.3.0.
Can CVE-2025-64126 be exploited remotely?
Yes, CVE-2025-64126 can be exploited remotely by an unauthenticated attacker due to the nature of the input validation flaw.
Is authentication required to exploit CVE-2025-64126?
No, authentication is not required to exploit CVE-2025-64126 as it allows unauthenticated access to the vulnerable input.