Zenitel VSF-Turbine, Fortitude6, Fortitude8, and ZIPS Authenticated Remote Code Execution Vulnerability via Uploaded Files

A vulnerability exists in Zenitel's VSF-Turbine, Fortitude6, Fortitude8, and ZIPS products, allowing authenticated attackers to execute arbitrary commands on the underlying system by manipulating the file name of an uploaded file. This issue affects several different versions and ranges of the respective products.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected system, potentially allowing for further exploitation or manipulation of the device.

Remediation

Users can upgrade to Zenitel's VSF-Turbine, Fortitude6, Fortitude8, or ZIPS versions 9.3.3.1 or later (8.2.3.5 for legacy TCIV) to address this vulnerability.