CVE-2026-95379Zenitel VSFF6
NVD
Vulnerability Summary
Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
CVSS v4.0 Base Metrics — Score 7.0 (HIGH)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/S:PAttack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredHigh
User InteractionNone
Confidentiality (Vulnerable System)None
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)Low
Availability (Subsequent System)Low
Affected & Patched Versions
- Zenitel VSFF6 >= 10.0.3.0 and < 10.1.3.0
- Zenitel VSFF8 >= 10.0.3.0 and < 10.1.3.0
- Zenitel VSFF8MP >= 10.0.3.0 and < 10.1.3.0
- Zenitel VSFF8MN >= 10.0.3.0 and < 10.1.3.0
- Zenitel VSFT >= 10.0.3.0 and < 10.1.3.0
- Zenitel VSFF6 10.1.3.0
- Zenitel VSFF8 10.1.3.0
- Zenitel VSFF8MP 10.1.3.0
- Zenitel VSFF8MN 10.1.3.0
- Zenitel VSFT 10.1.3.0
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is high.
- Check whether you run Zenitel VSFF6 and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Nov 13, 2026Published
- Nov 13, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Zenitel VSFF6 CVEsYou are reading CVE-2026-95379. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsMore Zenitel VSFF6 CVEs
External References
Data last checked: Nov 13, 2026 16:14 UTC