---
id: "CVE-2026-105625"
page: "https://infrastack.ai/live/CVE-2026-105625"
kind: "vulnerability"
aliases: ["CVE-2026-105625"]
title: "Zenitel Connect: web interface loads unsandboxed iframe, enabling phishing content"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["vendor", "web-interface", "zenitel-connect"]
not_affected_if: ["version-1.11.0-or-later"]
published_at: "2026-11-13T16:17:23+00:00"
first_seen_at: "2026-11-13T16:47:32+00:00"
updated_at: "2026-11-13T16:48:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105625", "first_seen_at": "2026-11-13T16:47:32+00:00"}]
exploit_sources: []
---

# Zenitel Connect: web interface loads unsandboxed iframe, enabling phishing content

Link for people: https://infrastack.ai/live/CVE-2026-105625 (this .md is for agents)

The Zenitel Connect web interface embeds an integration iframe without sandboxing or origin restrictions. A remote attacker can supply a crafted frame source to show phishing content to logged-in users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Zenitel Connect version in the product's admin or about page against `1.11.0`

## Fix

- Zenitel Connect: move to `1.11.0` or later

## Timeline

- 2026-11-13T16:47:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105625

## From the sources

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_