CVE-2026-95378 in VSFF6
Summary
by MITRE • 11/13/2026
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices represents a critical path traversal flaw within the certificate upload endpoint of the turbineweb web interface. This security defect affects software versions ranging from 10.0.3.0 up to, but not including, version 10.1.3.0. The core issue stems from insufficient input validation and access control mechanisms in the /api/certificate/upload API endpoint. Specifically, when an authenticated administrator submits a multipart upload request with the type field set to any value other than https_certificate, the system fails to perform both path traversal checks on the filename parameter and content validation of the uploaded file. This conditional logic flaw creates a significant attack surface where standard security controls are bypassed based solely on the specified certificate type.
From a technical perspective, this vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The attacker exploits the lack of sanitization in the filename parameter by injecting relative paths such as ../../../../etc/ or similar constructs into the multipart form data. Because the validation logic is skipped for non-https_certificate types, the web application writes these files directly to arbitrary locations on the server's file system with root privileges. This behavior indicates a severe failure in implementing the principle of least privilege and proper input sanitization within the backend service handling certificate uploads. The ability to write files as root significantly amplifies the severity of this vulnerability beyond typical local file inclusion or path traversal issues, which are often limited by user permissions.
The operational impact of this flaw is profound due to its potential for privilege escalation leading to arbitrary code execution with root-level access. An authenticated attacker can leverage this capability to overwrite critical system configuration files, modify startup scripts such as those in /etc/init.d/ or systemd units, or plant SSH public keys into the authorized_keys file for the root user. By modifying startup scripts, an attacker ensures persistent backdoor access that survives reboots and service restarts. Alternatively, planting SSH keys allows direct shell access without needing to exploit further vulnerabilities for authentication bypass. This effectively grants full control over the affected device, compromising its confidentiality, integrity, and availability. In industrial or critical infrastructure contexts where Zenitel devices are deployed, such compromise could lead to disruption of communication systems or unauthorized monitoring capabilities.
This vulnerability aligns with MITRE ATT&CK techniques related to persistence and privilege escalation. Specifically, it maps to T1505: Server Software Component (via planting SSH keys) and potentially T1034: Remote Service Sign-in via Web Interface if the attacker uses the compromised root access for further lateral movement. The exploitation requires authentication, which classifies this as an authenticated attack vector under ATT&CK framework guidelines regarding initial access requirements. However, since administrative credentials are often highly privileged targets, successful compromise of these accounts leads directly to system-level control rather than just user-level data theft.
Mitigation strategies must prioritize immediate patching to version 10.1.3.0 or later where the vendor has addressed this logic flaw. Until patches can be applied, administrators should restrict network access to the turbineweb interface using firewall rules and ensure that only trusted management stations have connectivity to these devices. Additionally, implementing strict input validation on all file upload endpoints is essential; developers must enforce allowlists for allowed filenames and validate content types server-side regardless of client-supplied parameters. Security monitoring tools should be configured to detect anomalous file write operations in system directories like /etc or /root, which would indicate active exploitation attempts. Regular audits of administrative account usage and strict enforcement of multi-factor authentication can also reduce the risk of credential compromise leading to this exploit chain.