CVE-2025-59815CWE-77command-injection

CVE-2025-59815

High · published September 26, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-09-26T00:15Z
References (2)
https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System · [email protected]https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes · [email protected]
EPSS history
Timeline
  • 25 SEP 19:29Z
    Authenticated Remote Code Execution in the Billing Administration portal
    cvelistv5