PT-2026-1841 · Zenitel · Tcis-3++2

Published 2025-12-19 · Updated 2026-01-09 · CVE-2025-64090

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2026

Description This issue enables authenticated attackers to execute commands via the hostname of the device. The vulnerability allows for authenticated remote code execution. The affected devices are not specified. The vulnerability involves the exploitation of the hostname setting to inject and execute arbitrary commands. There are no details about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2026-00265

CVE-2025-64090

Affected Products

Tcis-3+

Vs-Is

Tcis-3 Firmware

References · 8

• https://zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00265 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64090 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64090 · Vendor Advisory
• https://twitter.com/CVEnew/status/2009578263396691984 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009664521648947648 · Twitter Post
• https://t.me/CVEtracker/41810 · Telegram Post
• https://t.me/cveNotify/148271 · Telegram Post