CVE-2026-95614 in Connect
Summary
by MITRE • 11/13/2026
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in Zenitel Connect versions prior to 1.11.0 represents a critical security flaw rooted in improper separation of privileges and insecure handling of shared storage volumes within a containerized environment. The core issue lies in the operation of the host configuration watcher, which is responsible for monitoring changes to rsyslog configuration files located on a data volume that is mounted into both the host operating system and the hiatus application container. This architectural design creates a direct bridge between the unprivileged or semi-privileged context of the application container and the privileged root level of the underlying host OS. By allowing local attackers who have gained write access to the filesystem within the hiatus container to modify these configuration files, the system inadvertently provides a mechanism for privilege escalation that bypasses standard container isolation boundaries.
From a technical perspective, this flaw exploits the trust relationship between the application layer and the infrastructure management tools. The rsyslog daemon typically runs with high privileges on Linux systems because it needs access to various log sources and network interfaces. When the configuration watcher detects changes in the shared volume, it applies these configurations directly to the host's rsyslog service without sufficient validation or sanitization of the input content. An attacker who has compromised the hiatus container can craft a malicious rsyslog configuration file containing directives that execute arbitrary operating system commands. Because the configuration is applied by the watcher running with elevated privileges on the host, the resulting command execution occurs in the context of root, granting the attacker full control over the underlying server infrastructure rather than just the isolated application environment.
The operational impact of this vulnerability is severe, as it effectively nullifies the security benefits provided by containerization. Container isolation relies heavily on the assumption that processes within a container cannot affect the host or other containers unless explicitly permitted through secure mechanisms. In this scenario, an attacker with local access to the hiatus container can escalate their privileges from a potentially low-privileged application user to root on the host OS. This allows for complete compromise of the Zenitel Connect server, including the ability to install persistent backdoors, exfiltrate sensitive data stored on the host, pivot to other systems within the network, and disrupt critical communication services managed by the platform. The attack vector is local but requires initial access to the container filesystem, which could be achieved through various means such as exploiting a separate vulnerability in the application code or via misconfigured permissions that allow unauthorized file writes.
This issue aligns with CWE-94, Improper Control of Generation of Code (Code Injection), specifically where user-controlled data influences executable configuration files processed by privileged services. It also relates to CWE-250, Execution with Unnecessary Privileges, as the host configuration watcher operates at a higher privilege level than necessary for validating simple file changes if proper sandboxing or validation were implemented. Furthermore, from an ATT&CK perspective, this vulnerability facilitates lateral movement and privilege escalation techniques, specifically mapping to T1068 Exploitation for Privilege Escalation and potentially T1543 Create or Modify System Process when the attacker establishes persistence on the host system after gaining root access.
To mitigate this risk, organizations running Zenitel Connect versions earlier than 1.11.0 should immediately upgrade to version 1.11.0 or later where these architectural flaws have been addressed. If upgrading is not immediately feasible, administrators should enforce strict file permission controls on the shared data volume to ensure that only authorized system accounts can write to the rsyslog configuration files within the container context. Additionally, implementing mandatory access control policies such as SELinux or AppArmor profiles for both the hiatus container and the host services can restrict the ability of processes in one domain to affect configurations in another. Regular auditing of shared volumes and monitoring for unexpected modifications to system configuration files are also recommended defensive measures to detect potential exploitation attempts early.