CVE-2025-59818: Zenitel Tcis-3 Firmware Command Injection via Uploaded File Name
CVE-2025-59818 is a command injection flaw (CWE-77) in Zenitel Tcis-3 Firmware versions below 9.2.3.3, according to the record. The description says an authenticated user can run arbitrary commands on the underlying system through the file name of an uploaded file. NVD rates it 9.8 (CVSS 3.1) and the CNA rates it 10, but the record lists no fixed version and no confirmed exploitation.
Overview
CVE-2025-59818 is classified as command injection (CWE-77) affecting Zenitel Tcis-3 Firmware. The record describes a flaw that lets an authenticated user run arbitrary commands on the underlying system by using the file name of an uploaded file. The record was published on 2026-02-04 and has source status Analyzed.
Impact
NVD assigns a base score of 9.8 under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges required and high impact on confidentiality, integrity and availability. The CNA cert@ncsc.nl scored it 10 under CVSS 3.1. Successful command execution would allow an attacker to act on the device with the access of the vulnerable process, and the exact consequences depend on the deployment, which the record does not describe.
Affected products and versions
- Zenitel Tcis-3 Firmware: versions below 9.2.3.3, as listed in the record.
- The record contains no fixed version and no fix entries.
- The record references release notes for 9.3 of several Zenitel product lines (Turbine, VSF-Fortitude6, ZIPS, VSF-Fortitude8 and VSF-Display Series). Their content is not part of the record, so whether they address this CVE cannot be confirmed here.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted for this analysis, and no EPSS score is available.
Remediation and mitigation
- Review the Zenitel security advisory and confirm with the vendor which firmware build resolves the issue.
- Inventory Tcis-3 devices and identify any running firmware below 9.2.3.3.
- Restrict access to the web or management interfaces and upload functions to trusted administrators and trusted networks, and segment these devices from general user networks.
- Treat uploaded file names as untrusted input in any local process that consumes them, and apply the vendor update once validated.
Detection guidance
- Review device and management logs for uploads from unexpected accounts or sources.
- Look for file names containing unusual shell-related characters or unexpected lengths, and for unexpected process or configuration changes after upload activity.
- Forward logs to a central system so that changes can be correlated over time.
Limitations of the available information
- The record gives no fixed version, so the remediation status of each firmware line is unknown.
- The description says the attacker must be authenticated, but the CVSS vector records PR:N (no privileges required). The sources do not resolve this difference, so the actual precondition should be confirmed with the vendor.
- No EPSS or SSVC data is available, and the vendor advisory text is not included in the record.
Frequently asked questions
Is CVE-2025-59818 being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.
Which Zenitel versions are affected?
The record lists Zenitel Tcis-3 Firmware versions below 9.2.3.3. It does not list a fixed version, so the vendor advisory should be checked for the build that resolves the issue.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.