CVE-2026-95379 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate.deleteCertificate JSON-RPC method, where a relative path in file_name is not restricted. An authenticated administrator can delete any file on the device as root, which can disable the device or remove firewall rules and certificate trust stores.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Devices running Zenitel turbineweb software from 10.0.3.0 before 10.1.3.0 are exposed, and only an authenticated administrator can trigger the flaw. Teams that run these intercom devices should look at them; teams without them can skip it.
Not affected if no-admin-access-exposed, software-10.1.3.0-or-later
Who cares embedded, intercom, vsff6, vsff8, vsft, zenitel
10.1.3.0 or later.Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.