Cyber Resilience

CVE-2025-64126

CriticalRCE

Published: 26 November 2025

Published
26 November 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0832 92.5th percentile
Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-64126 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zenitel (inferred from references). Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

An OS command injection vulnerability tracked as CVE-2025-64126 arises from improper input validation in an affected application. The component accepts a user-supplied parameter without verifying it as a valid IP address or filtering dangerous characters, enabling arbitrary command execution. The flaw is assigned CWE-78 and carries a maximum CVSS 4.0 score of 10.0 reflecting network attack vector, low complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can supply crafted input to inject and execute operating system commands, resulting in high impact to confidentiality, integrity, and availability on the target system as well as potential secondary effects on related components.

CISA's ICS advisory ICSA-25-329-03 and the linked vendor firmware package direct users to apply available station and device updates from the Zenitel downloads repository to address the issue. The associated EPSS score rose from a low baseline to a peak of 0.1088 on 2026-03-28 before receding to the current value of 0.0832, indicating that exploitation interest emerged after disclosure.

EU & UK References

Vulnerability details

An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to…

more

inject arbitrary commands.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Unauthenticated remote OS command injection in a public-facing application enables exploitation of public-facing apps (T1190) and arbitrary command execution via scripting interpreters (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-60962Shared CWE-78
CVE-2025-23316Shared CWE-78
CVE-2026-30880Shared CWE-78
CVE-2025-64124Shared CWE-78
CVE-2024-58274Shared CWE-78
CVE-2026-34188Shared CWE-78
CVE-2025-0680Shared CWE-78
CVE-2026-5965Shared CWE-78
CVE-2025-50194Shared CWE-78
CVE-2026-44590Shared CWE-78

Affected Assets

Zenitel
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of user-supplied inputs expected to be IP addresses, preventing OS command injection from unverified parameters.

prevent

Mandates identification, reporting, and correction of the specific flaw in input validation, enabling patching or firmware updates to eliminate the vulnerability.

prevent

Enforces restrictions on input types and formats at system boundaries, blocking malicious characters in IP address parameters before they reach command execution.

References