Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API
Summary
| CVE | CVE-2026-95615 |
|---|---|
| State | PUBLISHED |
| Assigner | Zenitel |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-13 16:19:38 UTC |
| Updated | 2026-11-13 20:19:06 UTC |
| Description | OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.011730000 probability, percentile 0.679990000 (date 2026-11-14)
Problem Types: CWE-78 | CWE-78 CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
LowUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Zenitel | Zenitel Connect | affected 1.11.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advis... | cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e | www.zenitel.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Reported by Kevin Schaller and Dominik Schneider from Amazon Security (en)
Additional Advisory Data
Solutions
CNA: Upgrade to version 1.11.0
There are currently no legacy QID mappings associated with this CVE.