BaseFortify

Executive Summary

This is an OS command injection vulnerability in Zenitel EdgeAudioClient's TFTP provisioning module. It allows unauthenticated attackers on the same network segment to execute arbitrary commands as root by exploiting a crafted DHCP option 66 (TFTP Server Name) value. The vulnerability occurs because the DHCP-supplied value is passed directly to a shell without proper sanitization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious DHCP option 66 (TFTP Server Name) values containing shell metacharacters or commands. Inspect device logs for unexpected command executions or root-level processes spawned during DHCP lease renewals. Check configuration files for unauthorized modifications to TFTP server fields like config_update_tftp_server or sw_update_tftp_server.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control over affected devices, including VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT models. Since devices using DHCP are affected on every boot and lease renewal, the risk is persistent. Attackers could install malware, steal data, or disrupt operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information. Compliance failures may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Zenitel EdgeAudioClient to version 9.6.3.0 or later for 9.x series, or 10.1.3.0 or later for 10.x series. Disable DHCP on affected devices if possible, or ensure DHCP servers are trusted and properly configured. Restrict network access to only necessary devices and monitor for unauthorized configuration changes.

Useful 0 Not Useful 0