ZE
Vendor
Zenitel
30
CVEs
0
On KEV
0
New 30D
Products
IC9.8
ICX500
Zenitel
5 CVEs0 on KEV0 new
IC9.8
ICX510
Zenitel
5 CVEs0 on KEV0 new
TC10.0
TCIV-3+
Zenitel
5 CVEs0 on KEV0 new
TC9.8
TCIS-3+
Zenitel
4 CVEs0 on KEV0 new
TF9.8
Tcis-3 Firmware
Zenitel
3 CVEs0 on KEV0 new
AL8.8
alphacom_xe_audio_server
zenitel
2 CVEs0 on KEV0 new
IF9.8
Icx500 Firmware
Zenitel
2 CVEs0 on KEV0 new
IF9.8
Icx510 Firmware
Zenitel
2 CVEs0 on KEV0 new
IF6.1
Ip-stationweb Firmware
Zenitel
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-59819 | AL alphacom_xe_audio_server zenitel | 6.5 | Feb 20 | Authenticated Arbitrary File Read via filepath parameter |
| CVE-2025-59818 | TC TCIS-3+ Zenitel | 9.8 | Feb 4 | Authenticated Remote Code Execution via the file name of an uploaded file |
| CVE-2025-64093 | IC ICX500 Zenitel | 9.8 | Jan 9 | Unauthenticated Remote Code Execution via the device hostname |
| CVE-2025-64092 | IC ICX500 Zenitel | 7.5 | Jan 9 | Unauthenticated SQL injection via GET request parameters |
| CVE-2025-64091 | TC TCIS-3+ Zenitel | 8.8 | Jan 9 | Authenticated Remote Code Execution in the NTP-configuration |
| CVE-2025-64090 | TC TCIS-3+ Zenitel | 8.8 | Jan 9 | Authenticated Remote Code Execution in device hostname |
| CVE-2025-64130 | TC TCIV-3+ Zenitel | 9.8 | Nov 26 | Zenitel TCIV-3+ Cross-site Scripting |
| CVE-2025-64129 | TC TCIV-3+ Zenitel | 7.6 | Nov 26 | Zenitel TCIV-3+ Out-of-bounds Write |
| CVE-2025-64128 | TC TCIV-3+ Zenitel | 10.0 | Nov 26 | Zenitel TCIV-3+ OS Command Injection |
| CVE-2025-64127 | TC TCIV-3+ Zenitel | 10.0 | Nov 26 | Zenitel TCIV-3+ OS Command Injection |
| CVE-2025-64126 | TC TCIV-3+ Zenitel | 10.0 | Nov 26 | Zenitel TCIV-3+ OS Command Injection |
| CVE-2025-59817 | TC TCIS-3+ Zenitel | 8.4 | Sep 25 | Authenticated Remote Code Execution in zForm_auto_config |
| CVE-2025-59816 | IC ICX500 Zenitel | 7.3 | Sep 25 | Authenticated Union based SQL-injection in the search input field |
| CVE-2025-59815 | IC ICX510 Zenitel | 8.4 | Sep 25 | Authenticated Remote Code Execution in the Billing Administration portal |
| CVE-2025-59814 | IC ICX500 Zenitel | 8.8 | Sep 25 | Unauthenticated SQL-injection in password field |
| CVE-2021-40845 | AX Alphacom XE Audio Server Zenitel | 8.8 | Sep 15 | The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php |
| CVE-2018-19927 | IF Ip-stationweb Firmware Zenitel | 4.8 | Dec 6 | Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick… |
| CVE-2018-19926 | IF Ip-stationweb Firmware Zenitel | 6.1 | Dec 6 | Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATH_INFO |