CVE-2026-95378 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate upload endpoint. An authenticated administrator can write arbitrary files as root, which can be escalated to code execution as root.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Affected devices are Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT units running software from 10.0.3.0 before 10.1.3.0. The flaw needs an authenticated administrator account on the turbineweb interface, and the upload path is only exploitable when the type field is set to a value other than https_certificate. Teams that run these intercom or audio devices should check their firmware and restrict who can reach the admin interface.
Not affected if admin-access-restricted, patched-firmware
Who cares embedded, turbineweb, vsff, vsft, zenitel
10.1.3.0, per the sources.Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.