CVE-2026-95377: OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.
The same injection is also reachable via the configupdatetftpserver and swupdatetftpserver configuration fields by an attacker able to modify the device configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.6.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.3.0
Event History
Frequently Asked Questions
Which devices and software versions are affected?
Affected devices are VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT models running EdgeAudioClient versions earlier than 9.6.3.0, or 10.x versions earlier than 10.1.3.0.
What access does an attacker need to exploit the DHCP path?
An attacker must be adjacent to the target on the same network segment and able to operate or impersonate a DHCP server that can supply a crafted DHCP option 66 value. No authentication to the device is required.
Are devices using the default configuration exposed?
Yes. DHCP is the default configuration, and affected devices process the vulnerable DHCP option 66 value on every boot and DHCP lease renewal.
What can be done if an update cannot be installed immediately?
Prevent untrusted or rogue DHCP servers from serving the device network segment, since exploitation requires delivery of the malicious option 66 value from DHCP. Also restrict who can modify device configuration fields, because config_update_tftp_server and sw_update_tftp_server provide another reachable injection path.
Does successful exploitation run with limited permissions?
No. The injected command is executed as root, allowing arbitrary commands with root privileges on the affected device.