PT-2026-1844 · Zenitel · Zenitel Icx500+1

Published 2026-01-09 · Updated 2026-02-10 · CVE-2025-64093

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zenitel ICX500 and ICX510

Description A remote code execution issue exists that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device. The issue allows for the execution of commands without requiring authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-64093

Affected Products

Zenitel Icx500

Zenitel Icx510

References · 9

• https://osv.dev/vulnerability/CVE-2025-64093 · Vendor Advisory
• https://zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64093 · Security Note
• https://t.me/cveNotify/151629 · Telegram Post
• https://t.me/CVEtracker/41820 · Telegram Post
• https://twitter.com/vuldb/status/2009590501281001679 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009659402018562201 · Twitter Post
• https://twitter.com/CVEnew/status/2009578254492147975 · Twitter Post
• https://t.me/cveNotify/148274 · Telegram Post