High severity · published Sep 25, 2025
CVE-2025-59815
Authenticated Remote Code Execution in the Billing Administration portal
8.4
CVSS
0.3%
EPSS
No
On KEV
Description
This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
ICX500 · Zenitel
<1.4.3.3 · source: vendor
IC
ICX510 · Zenitel
<1.4.3.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59815
wiki.zenitel.com
https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System
wiki.zenitel.com
https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes
More from ICX500
9.8
CVE-2025-64093
Unauthenticated Remote Code Execution via the device hostname
8.8
CVE-2025-59814
Unauthenticated SQL-injection in password field
7.5
CVE-2025-64092
Unauthenticated SQL injection via GET request parameters
7.3
CVE-2025-59816
Authenticated Union based SQL-injection in the search input field