Zenitel TCIV-3+ prior 9.3.3.0 out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, has been found in Zenitel TCIV-3+. The impacted element is an unknown function. The manipulation leads to out-of-bounds write. This vulnerability is listed as CVE-2025-64129. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Zenitel TCIV-3+. It has been rated as critical. This issue affects an unknown functionality. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device.

The advisory is shared at cisa.gov. The identification of this vulnerability is CVE-2025-64129. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 9.3.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199737). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Zenitel

Name

• TCIV-3+

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion