Zenitel VSFF6/VSFF8/VSFF8MP/VSFF8MN/VSFT prior 10.1.3.0 Turbineweb Web Interface /api/rpc certificate.deleteCertificate file_name path traversal

Summaryinfo

A vulnerability marked as problematic has been reported in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT. The impacted element is the function certificate.deleteCertificate of the file /api/rpc of the component Turbineweb Web Interface. The manipulation of the argument file_name leads to path traversal. This vulnerability is uniquely identified as CVE-2026-95379. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN and VSFT. It has been rated as problematic. This issue affects the function certificate.deleteCertificate of the file /api/rpc of the component Turbineweb Web Interface. The manipulation of the argument file_name with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. The summary by CVE is:

Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter. This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.

It is possible to read the advisory at zenitel.com. The identification of this vulnerability is CVE-2026-95379 since 09/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are required for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 10.1.3.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Zenitel

Name

• VSFF6
• VSFF8
• VSFF8MN
• VSFF8MP
• VSFT

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion