URGENT PATCH REQUIRED: Zenitel TCIV-3+ Intercoms Hit by Multiple Critical Flaws (CVSS 9.8)

Zenitel has issued an urgent security advisory regarding critical vulnerabilities in its TCIV-3+ intercom station, affecting all versions prior to 9.3.3.0. The advisory highlights five security flaws, three of which have a maximum CVSS score of 9.8, including OS Command Injection vulnerabilities (CVE-2025-64126, CVE-2025-64127, CVE-2025-64128) that could allow unauthenticated attackers to execute arbitrary commands.

Additionally, there are two other significant vulnerabilities: a Cross-Site Scripting (XSS) flaw (CVE-2025-64130) and an Out-of-Bounds Write vulnerability (CVE-2025-64129). Users are advised to upgrade to version 9.3.3.0 or later to mitigate these risks.