CVE-2025-59815

Full vulnerability record from the local CVENow database.

Description

This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity.

Severity

HIGH

CVSS score

8.4 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2025-09-25 20:15:35.510000

Last modified

2026-10-18 21:10:00.120000

View original CVE JSON

{
  "id": "CVE-2025-59815",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-25T20:15:35.510",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad permite a actores maliciosos ejecutar comandos arbitrarios en el sistema subyacente del Gateway Zenitel ICX500 e ICX510, otorgando acceso de shell. La explotación puede comprometer la disponibilidad, confidencialidad e integridad del dispositivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Zenitel",
          "product": "ICX500",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "<1.4.3.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Zenitel",
          "product": "ICX510",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "<1.4.3.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-29T17:14:00.473701Z",
          "id": "CVE-2025-59815",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System",
      "source": "[email protected]"
    },
    {
      "url": "https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes",
      "source": "[email protected]"
    }
  ]
}