VulnHub

Real-time Cybersecurity News

Zenitel TCIV-3+

All CISA Advisories
CVEVulnerabilityUpdateCritical

Overview

The Zenitel TCIV-3+ device has critical vulnerabilities, including OS Command Injection and Cross-site Scripting, with a CVSS v4 score of 10.0, indicating a severe risk of arbitrary code execution and denial-of-service. Users are strongly advised to upgrade to version 9.3.3.0 or later to mitigate these risks.

Key Takeaways

  • Affected Systems: Zenitel TCIV-3+ (all versions prior to 9.3.3.0), vulnerabilities include OS Command Injection (CVE-2025-64126, CVE-2025-64127, CVE-2025-64128), Out-of-bounds Write (CVE-2025-64129), and Cross-site Scripting (CVE-2025-64130).
  • Action Required: Upgrade to Zenitel TCIV-3+ Version 9.
  • Timeline: Disclosed on November 25, 2025

Original Article Summary

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Zenitel Equipment: TCIV-3+ Vulnerabilities: OS Command Injection, Out-of-bounds Write, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in arbitrary code execution or cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of TCIV-3+ are affected: TCIV-3+: All versions prior to 9.3.3.0 3.2 VULNERABILITY OVERVIEW 3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78 An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary commands. CVE-2025-64126 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2025-64126. A base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H). 3.2.2 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78 An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely. CVE-2025-64127 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2025-64127. A base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H). 3.2.3 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78 An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands. CVE-2025-64128 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2025-64128. A base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H). 3.2.4 OUT-OF-BOUNDS WRITE CWE-787 The affected product is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device. CVE-2025-64129 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H). A CVSS v4 score has also been calculated for CVE-2025-64129. A base score of 7.0 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N). 3.2.5 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79 The affected product is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser. CVE-2025-64130 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A CVSS v4 score has also been calculated for CVE-2025-64130. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Communications COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Belgium 3.4 RESEARCHER Nir Tepper and Noam Moshe of Claroty Team82 reported these vulnerabilities to CISA. 4. MITIGATIONS Zenitel recommends users to upgrade to Version 9.3.3.0 or later. CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. 5. UPDATE HISTORY November 25, 2025: Initial Publication

Impact

Zenitel TCIV-3+ (all versions prior to 9.3.3.0), vulnerabilities include OS Command Injection (CVE-2025-64126, CVE-2025-64127, CVE-2025-64128), Out-of-bounds Write (CVE-2025-64129), and Cross-site Scripting (CVE-2025-64130).

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on November 25, 2025

Remediation

Upgrade to Zenitel TCIV-3+ Version 9.3.3.0 or later. Implement defensive measures such as minimizing network exposure for control system devices, using firewalls, and secure remote access methods like VPNs. Conduct proper impact analysis and risk assessment before deploying defensive measures.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Update, and 1 more.

Read Original Article

Related Coverage

ShowDoc Vulnerability Patched in 2020 Now Used in Active Server Takeovers

Hackread – Cybersecurity News, Data Breaches, AI and More

Hackers are currently exploiting a vulnerability in ShowDoc, identified as CVE-2025-0520, which was discovered five years ago. This flaw allows attackers to deploy web shells, enabling remote code execution (RCE) and complete server takeovers on affected systems. The exploitation of this vulnerability is happening globally, impacting various organizations that use ShowDoc. It’s crucial for users and companies to address this issue promptly to prevent unauthorized access and potential data breaches. Security teams should prioritize patching their systems to mitigate the risk posed by this vulnerability.

Apr 18, 2026

Operation PowerOFF: 75K Users of DDoS-for-Hire Services Identified and Warned

Hackread – Cybersecurity News, Data Breaches, AI and More

Operation PowerOFF has successfully identified and issued warnings to around 75,000 users of DDoS-for-hire services. This initiative, led by Europol, resulted in four arrests and the seizure of 53 domains associated with these illegal services. DDoS-for-hire, also known as 'booting', involves paying individuals or groups to launch distributed denial-of-service attacks against targeted websites or networks, causing disruption. The crackdown not only targets the providers but also the users who engage in these activities, highlighting the ongoing efforts to combat cybercrime. Users involved in these services face potential legal consequences, which raises awareness about the risks of participating in such illicit activities.

Apr 18, 2026

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

The Hacker News

Grinex, a cryptocurrency exchange based in Kyrgyzstan and already sanctioned by the U.K. and U.S., has announced the suspension of its operations following a cyber attack that resulted in the theft of $13.74 million. The exchange claims this attack was orchestrated by foreign intelligence agencies, suggesting a coordinated effort rather than a random act of cybercrime. This incident raises concerns not only for Grinex but also for the broader cryptocurrency market, as it highlights vulnerabilities within exchanges, especially those already under scrutiny. The attack's implications could deter users from engaging with platforms that have been targeted, thereby affecting market confidence. As the investigation unfolds, the exchange and its users are left grappling with the fallout from this significant breach.

Apr 18, 2026

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

The Hacker News

Researchers from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 have identified that attackers are exploiting a command injection vulnerability, CVE-2024-3721, in TBK DVRs and outdated TP-Link Wi-Fi routers. This medium-severity flaw, which has a CVSS score of 6.3, allows malicious actors to hijack these devices to create a botnet for DDoS attacks. The compromised TBK DVRs and EoL TP-Link routers are particularly concerning as they can be easily targeted due to their lack of ongoing support and security updates. This situation poses a significant risk to users, as their devices can be turned into tools for larger-scale cyberattacks without their knowledge. Users of these devices should take immediate action to secure their systems against potential exploitation.

Apr 18, 2026

US imposes extended jail time on North Korean laptop farm facilitators

SCM feed for Latest

Kejia Wang and Zhenxing Wang, two residents of New Jersey, have been sentenced to nine years and nearly eight years in prison, respectively, for their roles in facilitating a North Korean laptop farm. This operation was part of a scheme that falsely represented IT workers, generating over $5 million for the North Korean regime. The laptop farm was used to support various illicit activities, highlighting the ongoing challenges posed by cyber operations linked to North Korea. The U.S. Department of Justice's actions aim to disrupt these types of operations and send a clear message against aiding sanctioned regimes. This incident serves as a reminder of the global reach of cybercrime and the importance of international cooperation in combating it.

Apr 17, 2026

Another PoC exploit released by 'BlueHammer' leaker after Microsoft dispute

SCM feed for Latest

A security researcher known as Chaotic Eclipse has released a proof-of-concept (PoC) exploit for a zero-day vulnerability in Microsoft Defender, identified as 'RedSun'. This follows the earlier disclosure of an exploit for another flaw in Defender, tracked as CVE-2026-33825, known as the BlueHammer flaw. The implications of these exploits are significant, as they expose users of Microsoft Defender to potential attacks that could compromise system security. Organizations using this antivirus solution should be particularly vigilant, as the release of these exploits could lead to increased attempts at exploitation by malicious actors. It's crucial for users to stay informed about updates from Microsoft regarding these vulnerabilities.

Apr 17, 2026