CVE-2026-95615 - Vulnerability Details - OpenCVE

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zenitel	Zenitel Connect

No data.

No data.

References

Link	Providers
https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf

History

Sat, 14 Nov 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zenitel Zenitel zenitel Connect
Vendors & Products		Zenitel Zenitel zenitel Connect

Fri, 13 Nov 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.
Title		Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API
Weaknesses		CWE-78
References		https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Zenitel

Published: 2026-11-13T15:45:56.520Z

Updated: 2026-11-13T20:03:42.179Z

Reserved: 2026-09-22T09:56:15.657Z

Link: CVE-2026-95615

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-13T16:19:38.987

Modified: 2026-11-13T20:19:06.267

Link: CVE-2026-95615

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95615", "assignerOrgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "state": "PUBLISHED", "assignerShortName": "Zenitel", "dateReserved": "2026-09-22T09:56:15.657Z", "datePublished": "2026-11-13T15:45:56.520Z", "dateUpdated": "2026-11-13T20:03:42.179Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "shortName": "Zenitel", "dateUpdated": "2026-11-13T15:45:56.520Z"}, "title": "Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API", "datePublic": "2026-11-13T15:45:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE"}]}], "affected": [{"vendor": "Zenitel", "product": "Zenitel Connect", "versions": [{"status": "affected", "version": "0", "lessThan": "1.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "OS command injection\u00a0vulnerability\u00a0in audio messages API in Zenitel\u00a0Connect before 1.11.0 allows remote\u00a0authenticated users\u00a0to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the\u00a0/api/system/audio_messages endpoint.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint."}]}], "references": [{"url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to version 1.11.0", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div><span>Upgrade to version 1.11.0</span></div></div>"}]}], "credits": [{"lang": "en", "value": "Reported by Kevin Schaller and Dominik Schneider from Amazon Security", "type": "reporter"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T19:51:50.060942Z", "id": "CVE-2026-95615", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T20:03:42.179Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Zenitel Connect", "vendor": "Zenitel", "versions": [{"lessThan": "1.11.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OS command injection\u00a0vulnerability\u00a0in audio messages API in Zenitel\u00a0Connect before 1.11.0 allows remote\u00a0authenticated users\u00a0to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the\u00a0/api/system/audio_messages endpoint."}], "id": "CVE-2026-95615", "lastModified": "2026-11-13T20:19:06.267", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95615", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-13T19:51:50.060942Z", "version": "2.0.3"}}]}, "published": "2026-11-13T16:19:38.987", "references": [{"source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "url": "https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf"}], "sourceIdentifier": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e", "type": "Secondary"}]}