Zenitel TCIV-3+
Summary
The Zenitel TCIV-3+ device has critical vulnerabilities, including OS Command Injection and Cross-site Scripting, with a CVSS v4 score of 10.0, indicating a severe risk of arbitrary code execution and denial-of-service. Users are strongly advised to upgrade to version 9.3.3.0 or later to mitigate these risks.
Impact
Zenitel TCIV-3+ (all versions prior to 9.3.3.0), vulnerabilities include OS Command Injection (CVE-2025-64126, CVE-2025-64127, CVE-2025-64128), Out-of-bounds Write (CVE-2025-64129), and Cross-site Scripting (CVE-2025-64130).
In the Wild
No
Timeline
Disclosed on November 25, 2025
Remediation
Upgrade to Zenitel TCIV-3+ Version 9.3.3.0 or later. Implement defensive measures such as minimizing network exposure for control system devices, using firewalls, and secure remote access methods like VPNs. Conduct proper impact analysis and risk assessment before deploying defensive measures.