{"id":"CVE-2026-95378","kind":"vulnerability","aliases":["CVE-2026-95378"],"related":[],"title":"Zenitel VSFF devices: certificate upload lets admins write root files","description":"Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.\n\n\n\nThis can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.","summary":"The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate upload endpoint. An authenticated administrator can write arbitrary files as root, which can be escalated to code execution as root.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","turbineweb","vsff","vsft","zenitel"],"not_affected_if":["admin-access-restricted","patched-firmware"],"how_to_check":"- Check the firmware version on the device; the sources name software versions from 10.0.3.0 before 10.1.3.0 as affected.\n- Confirm whether the device models are VSFF6, VSFF8, VSFF8MP, VSFF8MN or VSFT.\n- Check whether the turbineweb interface on the device is reachable from networks that administrators do not control.","fix":"- Move affected devices to a version at or after `10.1.3.0`, per the sources.","status":"open","published_at":"2026-11-13T16:19:37+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","triaged_at":"2026-11-13T16:48:22+00:00","updated_at":"2026-11-13T16:48:22+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-13T16:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move affected devices to a version at or after `10.1.3.0`, per the sources.","reach":"network","title":"Zenitel VSFF devices: certificate upload lets admins write root files","impact":"high","summary":"The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate upload endpoint. An authenticated administrator can write arbitrary files as root, which can be escalated to code execution as root.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["zenitel","vsff","vsft","turbineweb","embedded"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"root code execution on the device, via overwritten startup scripts or SSH keys","analyst_note":"Check the Zenitel advisory for the vendor's own fix statement and whether the 10.1.3.0 fix is confirmed there; sources given only name NVD.","how_to_check":"- Check the firmware version on the device; the sources name software versions from 10.0.3.0 before 10.1.3.0 as affected.\n- Confirm whether the device models are VSFF6, VSFF8, VSFF8MP, VSFF8MN or VSFT.\n- Check whether the turbineweb interface on the device is reachable from networks that administrators do not control.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-firmware","admin-access-restricted"],"who_is_affected":"Affected devices are Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT units running software from 10.0.3.0 before 10.1.3.0. The flaw needs an authenticated administrator account on the turbineweb interface, and the upload path is only exploitable when the type field is set to a value other than https_certificate. Teams that run these intercom or audio devices should check their firmware and restrict who can reach the admin interface.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000819,"input_tokens":4670,"output_tokens":703,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-95378':13A,16A '/api/certificate/upload':68C '10.0.3.0':87C '10.1.3.0':89C 'admin':7A 'administr':45B,92C 'allow':90C 'arbitrari':48B,95C,139C 'authent':44B,91C 'case':124C 'certif':4A,40B,65C,121C,129C 'code':57B,140C 'content':130C 'craft':101C 'cve':11A,14A 'devic':3A,32B,82C 'embed':17B 'endpoint':42B,67C 'escal':55B,137C 'exampl':145C 'execut':58B,141C 'field':112C 'file':10A,49B,96C 'filenam':102C 'flaw':37B 'https':120C 'infrastructur':18B 'interfac':26B,73C 'key':153C 'let':6A 'multipart':106C 'overwrit':147C 'paramet':103C 'path':35B,61C,126C 'plant':151C 'request':108C 'root':9A,51B,60B,98C,143C 'script':149C 'set':114C 'skip':133C 'softwar':84C 'ssh':152C 'startup':148C 'travers':36B,62C 'turbineweb':19B,24B,71C 'type':111C 'upload':5A,41B,66C,107C 'valid':127C,131C 'valu':117C 'version':85C 'via':99C 'vsff':2A,20B,29B 'vsff6':76C 'vsff8':77C 'vsff8mn':79C 'vsff8mp':78C 'vsft':21B,31B,81C 'web':25B,72C 'write':8A,47B,94C 'zenitel':1A,22B,28B,75C","nicknames":[],"mitigations":[],"who_affected":"Affected devices are Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT units running software from 10.0.3.0 before 10.1.3.0. The flaw needs an authenticated administrator account on the turbineweb interface, and the upload path is only exploitable when the type field is set to a value other than https_certificate. Teams that run these intercom or audio devices should check their firmware and restrict who can reach the admin interface.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","infrastructure","turbineweb","vsff","vsft","zenitel"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95378':13A,16A 'admin':7A 'certif':4A 'cve':11A,14A 'devic':3A 'file':10A 'let':6A 'root':9A 'upload':5A 'vsff':2A 'write':8A 'zenitel':1A","search_b":"'administr':45B 'arbitrari':48B 'authent':44B 'certif':40B 'code':57B 'devic':32B 'embed':17B 'endpoint':42B 'escal':55B 'execut':58B 'file':49B 'flaw':37B 'infrastructur':18B 'interfac':26B 'path':35B 'root':51B,60B 'travers':36B 'turbineweb':19B,24B 'upload':41B 'vsff':20B,29B 'vsft':21B,31B 'web':25B 'write':47B 'zenitel':22B,28B","search_c":"'/api/certificate/upload':68C '10.0.3.0':87C '10.1.3.0':89C 'administr':92C 'allow':90C 'arbitrari':95C,139C 'authent':91C 'case':124C 'certif':65C,121C,129C 'code':140C 'content':130C 'craft':101C 'devic':82C 'endpoint':67C 'escal':137C 'exampl':145C 'execut':141C 'field':112C 'file':96C 'filenam':102C 'https':120C 'interfac':73C 'key':153C 'multipart':106C 'overwrit':147C 'paramet':103C 'path':61C,126C 'plant':151C 'request':108C 'root':98C,143C 'script':149C 'set':114C 'skip':133C 'softwar':84C 'ssh':152C 'startup':148C 'travers':62C 'turbineweb':71C 'type':111C 'upload':66C,107C 'valid':127C,131C 'valu':117C 'version':85C 'via':99C 'vsff6':76C 'vsff8':77C 'vsff8mn':79C 'vsff8mp':78C 'vsft':81C 'web':72C 'write':94C 'zenitel':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95378","severity":null,"published_at":"2026-11-13T16:19:37+00:00","modified_at":"2026-11-13T16:19:37+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","fetched_at":"2026-11-13T16:47:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}