CVE-2025-64091

HighRCE

Published: 09 January 2026

Published

09 January 2026

Modified

12 February 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0008 23.2th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-64091 is a high-severity OS Command Injection (CWE-78) vulnerability in Zenitel Tcis-3 Firmware. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of inputs to the NTP configuration interface to block OS command injection (CWE-78).

SI-2 Flaw Remediation good match

prevent

Mandates identification, reporting, and correction of the specific command injection flaw via vendor patches from the Zenitel advisory.

SI-9 Information Input Restrictions good match

prevent

Restricts NTP configuration inputs to organization-defined valid types (e.g., IP addresses only), preventing command injection payloads.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

OS command injection via exposed NTP config interface directly enables remote exploitation of public-facing management app (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.

Deeper analysisAI

CVE-2025-64091 is an OS command injection vulnerability (CWE-78) affecting Zenitel devices, enabling authenticated attackers to execute arbitrary commands through the NTP configuration interface. Published on 2026-01-09, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to network accessibility, low attack complexity, no user interaction required, and a scope change with high confidentiality impact.

Authenticated attackers with network access to the device can exploit this vulnerability by manipulating the NTP configuration settings to inject and execute operating system commands. Successful exploitation grants command execution capabilities, potentially allowing unauthorized access to sensitive configuration data or system information, as reflected in the high confidentiality impact score.

The Zenitel Security Advisory (A100K12333), available at https://www.zenitel.com/sites/default/files/2025-12/A100K12333%20Zenitel%20Security%20Advisory.pdf, provides details on mitigation strategies and patches for affected devices.