Zenitel TCIS-3+ vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Zenitel TCIS-3+: 4 record(s), with affected versions and fixes.
CVE-2025-59818
Critical · 9.8
CWE-77 Feb 4, 2026
Zenitel Tcis-3 Firmware Command Injection via Uploaded File Name
This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.
CVE-2025-64091
High · 8.8
CWE-78 Jan 9, 2026
Authenticated Remote Code Execution in the NTP-configuration
This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.
CVE-2025-64090
High · 8.8
CWE-77 Jan 9, 2026
Authenticated Remote Code Execution in device hostname
This vulnerability allows authenticated attackers to execute commands via the hostname of the device.
CVE-2025-59817
High · 8.4
CWE-77 Sep 25, 2025
Authenticated Remote Code Execution in zForm_auto_config
This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, confidentiality, and integrity.