---
id: "CVE-2026-95378"
page: "https://infrastack.ai/live/CVE-2026-95378"
kind: "vulnerability"
aliases: ["CVE-2026-95378"]
title: "Zenitel VSFF devices: certificate upload lets admins write root files"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "turbineweb", "vsff", "vsft", "zenitel"]
not_affected_if: ["admin-access-restricted", "patched-firmware"]
published_at: "2026-11-13T16:19:37+00:00"
first_seen_at: "2026-11-13T16:47:35+00:00"
updated_at: "2026-11-13T16:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95378", "first_seen_at": "2026-11-13T16:47:35+00:00"}]
exploit_sources: []
---

# Zenitel VSFF devices: certificate upload lets admins write root files

Link for people: https://infrastack.ai/live/CVE-2026-95378 (this .md is for agents)

The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate upload endpoint. An authenticated administrator can write arbitrary files as root, which can be escalated to code execution as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the device; the sources name software versions from 10.0.3.0 before 10.1.3.0 as affected.
- Confirm whether the device models are VSFF6, VSFF8, VSFF8MP, VSFF8MN or VSFT.
- Check whether the turbineweb interface on the device is reachable from networks that administrators do not control.

## Fix

- Move affected devices to a version at or after `10.1.3.0`, per the sources.

## Timeline

- 2026-11-13T16:47:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95378

## From the sources

Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.



This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_