{"id":"CVE-2026-95379","kind":"vulnerability","aliases":["CVE-2026-95379"],"related":[],"title":"Zenitel intercom web interface lets admins delete arbitrary root files","description":"Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.\n\n\n\nThis can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.","summary":"The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate.deleteCertificate JSON-RPC method, where a relative path in file_name is not restricted. An authenticated administrator can delete any file on the device as root, which can disable the device or remove firewall rules and certificate trust stores.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","intercom","vsff6","vsff8","vsft","zenitel"],"not_affected_if":["no-admin-access-exposed","software-10.1.3.0-or-later"],"how_to_check":"- Check the installed software version on the device and see whether it is from 10.0.3.0 before 10.1.3.0.\n- Confirm whether the device exposes the web interface at POST /api/rpc.\n- Review which accounts hold administrator rights on the device.","fix":"- Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT devices: move to software `10.1.3.0` or later.","status":"open","published_at":"2026-11-13T16:19:38+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","triaged_at":"2026-11-13T16:48:40+00:00","updated_at":"2026-11-13T16:48:40+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T16:48:40Z","model":"claude-haiku-5-5","output":{"fix":"- Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT devices: move to software `10.1.3.0` or later.","reach":"network","title":"Zenitel intercom web interface lets admins delete arbitrary root files","impact":"high","summary":"The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate.deleteCertificate JSON-RPC method, where a relative path in file_name is not restricted. An authenticated administrator can delete any file on the device as root, which can disable the device or remove firewall rules and certificate trust stores.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["zenitel","vsff6","vsff8","vsft","embedded","intercom"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"administrator deletes root system files, disabling the device or its security","analyst_note":"","how_to_check":"- Check the installed software version on the device and see whether it is from 10.0.3.0 before 10.1.3.0.\n- Confirm whether the device exposes the web interface at POST /api/rpc.\n- Review which accounts hold administrator rights on the device.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["software-10.1.3.0-or-later","no-admin-access-exposed"],"who_is_affected":"Devices running Zenitel turbineweb software from 10.0.3.0 before 10.1.3.0 are exposed, and only an authenticated administrator can trigger the flaw. Teams that run these intercom devices should look at them; teams without them can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4665,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-95379':13A,16A '/api/rpc':91C '10.0.3.0':110C '10.1.3.0':112C 'admin':6A 'administr':58B,115C 'allow':113C 'arbitrari':8A,118C 'authent':57B,114C 'caus':136C 'certif':78B,163C 'certificate.deletecertificate':41B,85C 'critic':147C 'cve':11A,14A 'delet':7A,60B,117C 'denial':137C 'devic':33B,65B,72B,105C,143C,153C 'disabl':70B 'embed':17B 'file':10A,51B,62B,119C,128C,149C,157C 'firewal':75B,160C 'flaw':38B 'infrastructur':18B 'inoper':144C 'intercom':2A,19B 'interfac':4A,27B,96C 'json':43B,87C 'json-rpc':42B,86C 'let':5A 'method':45B,89C 'name':52B,129C 'paramet':130C 'path':36B,49B,81C,125C 'post':90C 'relat':48B,124C 'remov':74B,146C,156C 'render':141C 'restrict':55B 'root':9A,67B,121C 'rpc':44B,88C 'rule':76B,161C 'secur':154C 'servic':139C 'softwar':107C 'store':80B,165C 'system':148C 'travers':37B,82C 'trust':79B,164C 'turbineweb':25B,94C 'use':134C 'version':108C 'via':122C 'vsff':30B 'vsff6':20B,99C 'vsff8':21B,100C 'vsff8mn':102C 'vsff8mp':101C 'vsft':22B,32B,104C 'weaken':152C 'web':3A,26B,95C 'zenitel':1A,23B,29B,98C","nicknames":[],"mitigations":[],"who_affected":"Devices running Zenitel turbineweb software from 10.0.3.0 before 10.1.3.0 are exposed, and only an authenticated administrator can trigger the flaw. Teams that run these intercom devices should look at them; teams without them can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","infrastructure","intercom","vsff6","vsff8","vsft","zenitel"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95379':13A,16A 'admin':6A 'arbitrari':8A 'cve':11A,14A 'delet':7A 'file':10A 'intercom':2A 'interfac':4A 'let':5A 'root':9A 'web':3A 'zenitel':1A","search_b":"'administr':58B 'authent':57B 'certif':78B 'certificate.deletecertificate':41B 'delet':60B 'devic':33B,65B,72B 'disabl':70B 'embed':17B 'file':51B,62B 'firewal':75B 'flaw':38B 'infrastructur':18B 'intercom':19B 'interfac':27B 'json':43B 'json-rpc':42B 'method':45B 'name':52B 'path':36B,49B 'relat':48B 'remov':74B 'restrict':55B 'root':67B 'rpc':44B 'rule':76B 'store':80B 'travers':37B 'trust':79B 'turbineweb':25B 'vsff':30B 'vsff6':20B 'vsff8':21B 'vsft':22B,32B 'web':26B 'zenitel':23B,29B","search_c":"'/api/rpc':91C '10.0.3.0':110C '10.1.3.0':112C 'administr':115C 'allow':113C 'arbitrari':118C 'authent':114C 'caus':136C 'certif':163C 'certificate.deletecertificate':85C 'critic':147C 'delet':117C 'denial':137C 'devic':105C,143C,153C 'file':119C,128C,149C,157C 'firewal':160C 'inoper':144C 'interfac':96C 'json':87C 'json-rpc':86C 'method':89C 'name':129C 'paramet':130C 'path':81C,125C 'post':90C 'relat':124C 'remov':146C,156C 'render':141C 'root':121C 'rpc':88C 'rule':161C 'secur':154C 'servic':139C 'softwar':107C 'store':165C 'system':148C 'travers':82C 'trust':164C 'turbineweb':94C 'use':134C 'version':108C 'via':122C 'vsff6':99C 'vsff8':100C 'vsff8mn':102C 'vsff8mp':101C 'vsft':104C 'weaken':152C 'web':95C 'zenitel':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95379","severity":null,"published_at":"2026-11-13T16:19:38+00:00","modified_at":"2026-11-13T16:19:38+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","fetched_at":"2026-11-13T16:47:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}