CVE-2025-59818
critical · 10This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.
10
CVSS
0.5%
EPSS (exploit prob.)
42nd
EPSS percentile
2026-02-04
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-77
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| zenitel | tcis-3_firmware | < 9.2.3.3 |
| zenitel | tcis-3 | all versions |
Check a specific version with /api/v1/cve/match.
References
- https://wiki.zenitel.com/wiki/Turbine_9.3_-_Release_notes
- https://wiki.zenitel.com/wiki/VSF-Display_Series_9.3_Release_Notes
- https://wiki.zenitel.com/wiki/VSF-Fortitude6_9.3_Release_Notes
- https://wiki.zenitel.com/wiki/VSF-Fortitude8_9.3_Release_Notes
- https://wiki.zenitel.com/wiki/ZIPS_9.3_-_Release_notes
- https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2025-59818