Vulnerability · Published Feb 4, 2026 · Assigned by NCSC-NL
CVE-2025-59818Authenticated Remote Code Execution via the file name of an uploaded file
Critical 10.0
In plain English
A critical-severity command injection in TCIS-3+ from Zenitel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- Zenitel Release Notes Turbine release-notes
- Zenitel Security Advisory vendor-advisory
- Zenitel Release Notes Fortitude8 release-notes
- Zenitel Release Notes ZIPS release-notes
- Zenitel Release Notes Fortitude6 release-notes
- Zenitel Release Notes Display Series release-notes