---
id: "CVE-2026-95379"
page: "https://infrastack.ai/live/CVE-2026-95379"
kind: "vulnerability"
aliases: ["CVE-2026-95379"]
title: "Zenitel intercom web interface lets admins delete arbitrary root files"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "intercom", "vsff6", "vsff8", "vsft", "zenitel"]
not_affected_if: ["no-admin-access-exposed", "software-10.1.3.0-or-later"]
published_at: "2026-11-13T16:19:38+00:00"
first_seen_at: "2026-11-13T16:47:35+00:00"
updated_at: "2026-11-13T16:48:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95379", "first_seen_at": "2026-11-13T16:47:35+00:00"}]
exploit_sources: []
---

# Zenitel intercom web interface lets admins delete arbitrary root files

Link for people: https://infrastack.ai/live/CVE-2026-95379 (this .md is for agents)

The turbineweb web interface on Zenitel VSFF and VSFT devices has a path traversal flaw in its certificate.deleteCertificate JSON-RPC method, where a relative path in file_name is not restricted. An authenticated administrator can delete any file on the device as root, which can disable the device or remove firewall rules and certificate trust stores.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed software version on the device and see whether it is from 10.0.3.0 before 10.1.3.0.
- Confirm whether the device exposes the web interface at POST /api/rpc.
- Review which accounts hold administrator rights on the device.

## Fix

- Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT devices: move to software `10.1.3.0` or later.

## Timeline

- 2026-11-13T16:47:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95379

## From the sources

Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.



This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_