Zenitel TCIV-3+ OS Command Injection Vulnerability

A command injection vulnerability has been identified in Zenitel TCIV-3+ intercom devices, all versions prior to 9.3.3.0. This vulnerability arises from inadequate input validation, allowing an unauthenticated attacker to execute arbitrary operating system commands remotely. The issue stems from the application accepting user-supplied parameters that are directly incorporated into OS commands without proper sanitization.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands on the affected system, potentially allowing for arbitrary code execution or causing a denial-of-service condition by crashing the device.

Remediation

Users are advised to upgrade to Zenitel TCIV-3+ Version 9.3.3.0 or later. For download information, visit the Zenitel Wiki.