Zenitel ICX500 and ICX510 Gateway Unauthorized Database Access Vulnerability

A vulnerability exists in the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, allowing unauthorized access to the Billing Admin database. This issue arises from a lack of proper authentication or authorization, enabling malicious actors to read the entire contents of the database.

Impact

Exploitation of this vulnerability could lead to unauthorized access and disclosure of sensitive billing information stored in the database.

Remediation

Users can upgrade to Zenitel ICX version 1.4.3.3, released on September 15, 2025, which includes security fixes and re-enables the billing web interface. Instructions for upgrading the ICX-500/510 can be found on the Zenitel Wiki.