Zenitel TCIV-3+ OS Command Injection Vulnerability

A command injection vulnerability has been identified in Zenitel TCIV-3+ intercom devices, all versions prior to 9.3.3.0. This vulnerability arises from inadequate validation of user input, allowing an unauthenticated attacker to inject arbitrary commands. The flaw enables exploitation by appending malicious data to parameters that are not properly sanitized before being executed as part of an operating system command.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands on the affected device, potentially allowing for arbitrary code execution or causing the device to crash, creating a denial-of-service condition.

Remediation

Users are advised to upgrade to Zenitel TCIV-3+ Version 9.3.3.0 or later. For download instructions, visit the Zenitel Wiki.