CVE-2026-105625: Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction

Q: Who is exposed to this issue?

Authenticated users of the Zenitel Connect web interface are the target. The affected condition is present in versions before 1.11.0.

Q: What does an attacker need to exploit it?

The attacker needs to cause an authenticated user to view a crafted frame source. The issue enables phishing content to be presented through the integration iframe.

Q: Is user interaction required?

Yes. The supplied vector indicates user interaction is required, and exploitation involves presenting phishing content to an authenticated user.

Q: What can be done if upgrading is not immediately possible?

The provided information does not specify a workaround. Reduce exposure by preventing authenticated users from accessing untrusted or attacker-controlled frame sources until an update is applied.

Published Nov 13, 2026

Updated

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.

Affected Software

1 affected component

Zenitel Zenitel Connect<1.11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:39 PM

Data Sourced

via MITRE·03:39 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Authenticated users of the Zenitel Connect web interface are the target. The affected condition is present in versions before 1.11.0.

What does an attacker need to exploit it?

The attacker needs to cause an authenticated user to view a crafted frame source. The issue enables phishing content to be presented through the integration iframe.

Is user interaction required?

Yes. The supplied vector indicates user interaction is required, and exploitation involves presenting phishing content to an authenticated user.

What can be done if upgrading is not immediately possible?

The provided information does not specify a workaround. Reduce exposure by preventing authenticated users from accessing untrusted or attacker-controlled frame sources until an update is applied.

CVE-2026-105625: Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

What can be done if upgrading is not immediately possible?