{"id":"CVE-2026-105625","kind":"vulnerability","aliases":["CVE-2026-105625"],"related":[],"title":"Zenitel Connect: web interface loads unsandboxed iframe, enabling phishing content","description":"The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.","summary":"The Zenitel Connect web interface embeds an integration iframe without sandboxing or origin restrictions. A remote attacker can supply a crafted frame source to show phishing content to logged-in users.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["vendor","web-interface","zenitel-connect"],"not_affected_if":["version-1.11.0-or-later"],"how_to_check":"- Check the installed Zenitel Connect version in the product's admin or about page against `1.11.0`","fix":"- Zenitel Connect: move to `1.11.0` or later","status":"open","published_at":"2026-11-13T16:17:23+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","triaged_at":"2026-11-13T16:48:56+00:00","updated_at":"2026-11-13T16:48:56+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-13T16:48:56Z","model":"claude-haiku-5-5","output":{"fix":"- Zenitel Connect: move to `1.11.0` or later","reach":"network","title":"Zenitel Connect: web interface loads unsandboxed iframe, enabling phishing content","impact":"low","summary":"The Zenitel Connect web interface embeds an integration iframe without sandboxing or origin restrictions. A remote attacker can supply a crafted frame source to show phishing content to logged-in users.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["zenitel-connect","web-interface"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users see attacker-chosen phishing content inside the app","analyst_note":"Confirm the vendor advisory and whether the frame source is user-controllable in default configuration.","how_to_check":"- Check the installed Zenitel Connect version in the product's admin or about page against `1.11.0`\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-1.11.0-or-later"],"who_is_affected":"Organizations running Zenitel Connect versions before 1.11.0 whose staff use its web interface. The sources do not describe the frame source configuration that makes the iframe attacker-controllable, so exposure depends on how the integration is set up.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4527,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105625':13A,16A '-2026':12A,15A '1.11.0':63C 'allow':74C 'attack':40B,76C 'authent':82C 'connect':2A,23B,26B,61C 'content':10A,50B,80C 'craft':44B,86C 'cve':11A,14A 'emb':29B 'enabl':8A 'frame':45B,87C 'ifram':7A,32B,67C 'integr':31B,66C 'interfac':4A,20B,28B,58C 'load':5A,64C 'log':53B 'logged-in':52B 'origin':36B,71C 'phish':9A,49B,79C 'present':78C 'remot':39B,75C 'restrict':37B,72C 'sandbox':34B,69C 'show':48B 'sourc':46B,88C 'suppli':42B 'unsandbox':6A 'user':55B,83C 'vendor':17B 'via':84C 'web':3A,19B,27B,57C 'web-interfac':18B 'without':33B,68C 'zenitel':1A,22B,25B,60C 'zenitel-connect':21B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Zenitel Connect versions before 1.11.0 whose staff use its web interface. The sources do not describe the frame source configuration that makes the iframe attacker-controllable, so exposure depends on how the integration is set up.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","vendor","webinterface","zenitelconnect"],"campaign_type":null,"search_a":"'-105625':13A,16A '-2026':12A,15A 'connect':2A 'content':10A 'cve':11A,14A 'enabl':8A 'ifram':7A 'interfac':4A 'load':5A 'phish':9A 'unsandbox':6A 'web':3A 'zenitel':1A","search_b":"'attack':40B 'connect':23B,26B 'content':50B 'craft':44B 'emb':29B 'frame':45B 'ifram':32B 'integr':31B 'interfac':20B,28B 'log':53B 'logged-in':52B 'origin':36B 'phish':49B 'remot':39B 'restrict':37B 'sandbox':34B 'show':48B 'sourc':46B 'suppli':42B 'user':55B 'vendor':17B 'web':19B,27B 'web-interfac':18B 'without':33B 'zenitel':22B,25B 'zenitel-connect':21B","search_c":"'1.11.0':63C 'allow':74C 'attack':76C 'authent':82C 'connect':61C 'content':80C 'craft':86C 'frame':87C 'ifram':67C 'integr':66C 'interfac':58C 'load':64C 'origin':71C 'phish':79C 'present':78C 'remot':75C 'restrict':72C 'sandbox':69C 'sourc':88C 'user':83C 'via':84C 'web':57C 'without':68C 'zenitel':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105625","severity":null,"published_at":"2026-11-13T16:17:23+00:00","modified_at":"2026-11-13T16:17:23+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","fetched_at":"2026-11-13T16:47:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}