{"id":"CVE-2026-95378","aliases":[],"cve":{"records":[{"id":"CVE-2026-95378","source":"Zenitel","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T05:16:24.841Z","published":"2026-11-13T15:45:14.968Z","modified":"2026-11-13T20:03:58.215Z"}],"publishers":[{"name":"Zenitel","role":"CNA","organizationId":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","modified":"2026-11-13T15:45:14.968Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T20:03:58.215Z"}],"references":[{"url":"https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf","tags":[],"source":"Zenitel"}],"weaknesses":[{"id":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","source":"Zenitel"},{"id":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","source":"Zenitel"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T19:52:26.219395Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root","titleSource":"Zenitel","descriptionSource":"Zenitel","description":"Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.","score":8.6,"severity":"high","published":"2026-11-13T15:45:14.968Z","modified":"2026-11-13T20:03:58.215Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Zenitel","name":"VSFF6","platforms":["Linux","ARM","32 bit"],"versions":[{"version":"10.0.3.0","status":"affected","lessThan":"10.1.3.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"},{"vendor":"Zenitel","name":"VSFF8","platforms":["Linux","ARM","64 bit"],"versions":[{"version":"10.0.3.0","status":"affected","lessThan":"10.1.3.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"},{"vendor":"Zenitel","name":"VSFF8MP","platforms":["Linux","ARM","64 bit"],"versions":[{"version":"10.0.3.0","status":"affected","lessThan":"10.1.3.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"},{"vendor":"Zenitel","name":"VSFF8MN","platforms":["Linux","ARM","64 bit"],"versions":[{"version":"10.0.3.0","status":"affected","lessThan":"10.1.3.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"},{"vendor":"Zenitel","name":"VSFT","platforms":["Linux","ARM","32 bit"],"versions":[{"version":"10.0.3.0","status":"affected","lessThan":"10.1.3.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"}],"remediation":[{"text":"Affected devices should upgrade to version 10.1.3.0 (and newer).","source":"Zenitel","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"}],"references":["https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"],"sources":[{"name":"CVE","id":"CVE-2026-95378","modified":"2026-11-13T20:03:58.215Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"}],"assessments":[{"source":"Zenitel","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P","score":8.6}],"sourceAffected":[],"observedAt":"2026-11-13T20:43:44.920Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:25:33.720Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T21:40:33.335Z","attemptedAt":"2026-11-13T21:40:33.335Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T21:25:36.055Z","attemptedAt":"2026-11-13T21:25:36.055Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T21:25:36.112Z","attemptedAt":"2026-11-13T21:25:36.112Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T21:25:35.673Z","attemptedAt":"2026-11-13T21:25:35.673Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-4hjx-4cg8-m339","url":"https://github.com/advisories/GHSA-4hjx-4cg8-m339","modified":"2026-11-13T18:32:37Z","checkedAt":"2026-11-13T21:25:36.055Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125524","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125524","modified":"Nov 13, 2026, 8:03:58 PM","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P","checkedAt":"2026-11-13T21:25:36.112Z"},{"source":"NVD","id":"CVE-2026-95378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95378","modified":"2026-11-13T20:19:03.120","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T21:40:33.335Z"}],"aiSummary":{"text":"Zenitel devices with software versions before 10.1.3.0 have a path traversal vulnerability in the certificate upload endpoint, allowing authenticated administrators to write arbitrary files as root. The vulnerability affects VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices. An attacker must have administrator access to exploit the weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T21:11:09.347Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95378"}]}}