CVE-2025-64090

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-09

Last updated on: 2026-02-12

Assigner: National Cyber Security Centre Netherlands (NCSC-NL)

Description

This vulnerability allows authenticated attackers to execute commands via the hostname of the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-09

Last Modified

2026-02-12

Generated

2026-07-06

AI Q&A

2026-01-10

EPSS Evaluated

2026-07-04

NVD

CVE-2025-64090

EUVD

EUVD-2026-1758

Affected Vendors & Products

Vendor	Product	Version / Range
zenitel	tcis-3_firmware	to 9.2.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Zenitel VS-IS firmware and allows authenticated attackers with administrative access to execute commands via the device's hostname. It stems from legacy web interface components that lacked sufficient input validation, enabling command execution through crafted hostname input. [1]

Impact Analysis

An attacker exploiting this vulnerability could execute arbitrary commands on the affected device, potentially leading to full compromise of the system. Given the CVSS score of 10.0, the impact includes complete confidentiality, integrity, and availability loss, which could disrupt device operations and expose sensitive information. [1]

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade all affected Zenitel VS-IS firmware devices to version 9.3.3.1 or later (for general VS-IS firmware) or version 8.2.3.5 or later (for TCIV). No further mitigation steps are necessary after applying these firmware updates. [1]

Hi! I’m here to help you understand CVE-2025-64090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70