CVE-2025-64091

HighRCE

Published: 09 January 2026

Published

09 January 2026

Modified

12 February 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0032 23.5th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-64091 is a high-severity OS Command Injection (CWE-78) vulnerability in Zenitel Tcis-3 Firmware. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-64091 is an OS command injection vulnerability (CWE-78) affecting Zenitel devices, enabling authenticated attackers to execute arbitrary commands through the NTP configuration interface. Published on 2026-01-09, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, no user interaction required, and a scope change with high confidentiality impact.

Authenticated attackers with network access to the device can exploit this vulnerability by manipulating the NTP configuration settings to inject and execute operating system commands. Successful exploitation grants command execution capabilities, potentially allowing unauthorized access to sensitive configuration data or system information, as reflected in the high confidentiality impact score.

The Zenitel Security Advisory (A100K12333), available at https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf, provides details on mitigation strategies and patches for affected devices.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-1764

Vulnerability details

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

OS command injection via exposed NTP config interface directly enables remote exploitation of public-facing management app (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0