CVE-2025-59814

Full vulnerability record from the local CVENow database.

Description

This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2025-09-25 20:15:35.357000

Last modified

2026-10-18 21:10:00.120000

View original CVE JSON

{
  "id": "CVE-2025-59814",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-25T20:15:35.357",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite a actores maliciosos obtener acceso no autorizado al endpoint Billing Admin de los gateways Zenitel ICX500 e ICX510, permitiéndoles leer el contenido completo de la base de datos Billing Admin."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Zenitel",
          "product": "ICX500",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "<1.4.3.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Zenitel",
          "product": "ICX510",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "<1.4.3.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-29T17:25:21.899215Z",
          "id": "CVE-2025-59814",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System",
      "source": "[email protected]"
    },
    {
      "url": "https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes",
      "source": "[email protected]"
    }
  ]
}