Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root
Summary
| CVE | CVE-2026-95378 |
|---|---|
| State | PUBLISHED |
| Assigner | Zenitel |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-13 16:19:37 UTC |
| Updated | 2026-11-13 20:19:03 UTC |
| Description | Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped. This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys. |
Risk And Classification
Primary CVSS: v4.0 8.6 HIGH from cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003260000 probability, percentile 0.261350000 (date 2026-11-14)
Problem Types: CWE-22 | CWE-434 | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CWE-434 CWE-434 Unrestricted Upload of File with Dangerous Type
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e | Secondary | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/C... |
| 4.0 | CNA | CVSS | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Zenitel | VSFF6 | affected 10.0.3.0 10.1.3.0 custom | Linux, ARM, 32 bit |
| CNA | Zenitel | VSFF8 | affected 10.0.3.0 10.1.3.0 custom | Linux, ARM, 64 bit |
| CNA | Zenitel | VSFF8MP | affected 10.0.3.0 10.1.3.0 custom | Linux, ARM, 64 bit |
| CNA | Zenitel | VSFF8MN | affected 10.0.3.0 10.1.3.0 custom | Linux, ARM, 64 bit |
| CNA | Zenitel | VSFT | affected 10.0.3.0 10.1.3.0 custom | Linux, ARM, 32 bit |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advis... | cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e | www.zenitel.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Reported by Kevin Schaller and Dominik Schneider from Amazon Security (en)
Additional Advisory Data
Solutions
CNA: Affected devices should upgrade to version 10.1.3.0 (and newer).