High severity · published Sep 25, 2025
CVE-2025-59817
Authenticated Remote Code Execution in zForm_auto_config
8.4
CVSS
0.2%
EPSS
No
On KEV
Description
This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges, successful exploitation grants full control over the device, potentially compromising its availability, confidentiality, and integrity.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
TCIS-3+ · Zenitel
<9.2.3.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59817
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59817
wiki.zenitel.com
https://wiki.zenitel.com/wiki/Downloads#Stations_and_Devices
More from TCIS-3+
9.8
CVE-2025-59818
Authenticated Remote Code Execution via the file name of an uploaded file
8.8
CVE-2025-64091
Authenticated Remote Code Execution in the NTP-configuration
8.8
CVE-2025-64090
Authenticated Remote Code Execution in device hostname