CVE-2025-64126
Published: 26 November 2025
Summary
CVE-2025-64126 is a critical-severity OS Command Injection (CWE-78) vulnerability in Zenitel (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
An OS command injection vulnerability tracked as CVE-2025-64126 arises from improper input validation in an affected application. The component accepts a user-supplied parameter without verifying it as a valid IP address or filtering dangerous characters, enabling arbitrary command execution. The flaw is assigned CWE-78 and carries a maximum CVSS 4.0 score of 10.0 reflecting network attack vector, low complexity, and no required authentication or user interaction.
An unauthenticated remote attacker can supply crafted input to inject and execute operating system commands, resulting in high impact to confidentiality, integrity, and availability on the target system as well as potential secondary effects on related components.
CISA's ICS advisory ICSA-25-329-03 and the linked vendor firmware package direct users to apply available station and device updates from the Zenitel downloads repository to address the issue. The associated EPSS score rose from a low baseline to a peak of 0.1088 on 2026-03-28 before receding to the current value of 0.0832, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199742
Vulnerability details
An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to…
more
inject arbitrary commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection in a public-facing application enables exploitation of public-facing apps (T1190) and arbitrary command execution via scripting interpreters (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied inputs expected to be IP addresses, preventing OS command injection from unverified parameters.
Mandates identification, reporting, and correction of the specific flaw in input validation, enabling patching or firmware updates to eliminate the vulnerability.
Enforces restrictions on input types and formats at system boundaries, blocking malicious characters in IP address parameters before they reach command execution.