9.8CRITICAL

CVE-2025-64130 — Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a…

Unknown · Unknown · Published 26 Nov 2025 · Modified 26 Sept 2026

Description

Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-329-03.json
https://wiki.zenitel.com/wiki/Downloads#Station_and_Device_Firmware_Package_.28VS-IS.29
https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-03

What to do

Check whether Unknown is in your asset inventory.
Patch in the next maintenance window; prioritise internet-facing systems.
Record the decision in your risk register for audit evidence.

Alert me on similar CVEs →

Link: adminadda.com/cve/CVE-2025-64130