PT-2025-48168 · Zenitel · Zenitel Tciv-3+

Published 2025-11-25 · Updated 2025-12-01 · CVE-2025-64128

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zenitel TCIV-3+ (affected versions not specified)

Description An OS command injection issue arises from insufficient validation of user-provided input. The validation process does not adequately enforce formatting rules, potentially allowing attackers to append arbitrary data. This could enable an unauthenticated attacker to inject and execute arbitrary commands. The vulnerability allows for complete system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14765

CVE-2025-64128

Affected Products

Zenitel Tciv-3+

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-64128 · Security Note
• https://bdu.fstec.ru/vul/2025-14765 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-329-03.json · Note
• https://twitter.com/0dayPublishing/status/1993762950838935743 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-329-03 · Note
• https://twitter.com/CVEnew/status/1993746744257946095 · Twitter Post
• https://twitter.com/gothburz/status/1994179989772615853 · Twitter Post
• https://twitter.com/SecAideInfo/status/1994711603032596704 · Twitter Post
• https://twitter.com/offseq/status/1993878001356882417 · Twitter Post
• https://twitter.com/cracbot/status/1995447862549971172 · Twitter Post
• https://twitter.com/CveFindCom/status/1993766816221454544 · Twitter Post
• https://wiki.zenitel.com/wiki/Downloads#Station_and_Device_Firmware_Package_.28VS-IS.29 · Note
• https://twitter.com/VulmonFeeds/status/1993773134239961343 · Twitter Post
• https://wiki.zenitel.com/wiki/Downloads · Note
• https://t.me/CVEtracker/38307 · Telegram Post