critical10.0
CVE-2025-59818
This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.
Impact
This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zenitel | Tcis-3 Firmware | before 9.2.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://wiki.zenitel.com/wiki/Turbine_9.3_-_Release_notes
- https://wiki.zenitel.com/wiki/VSF-Display_Series_9.3_Release_Notes
- https://wiki.zenitel.com/wiki/VSF-Fortitude6_9.3_Release_Notes
- https://wiki.zenitel.com/wiki/VSF-Fortitude8_9.3_Release_Notes
- https://wiki.zenitel.com/wiki/ZIPS_9.3_-_Release_notes
- https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf