The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HZenitel Alphacom Xe Audio Server
APPZenitel≤ 11.2.3.10
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References
Related vulnerabilities
CVE-2025-59818CRITICAL10.0PL ✓ten sam vendor
Command Injection w Zenitel Tcis-3 via nazwa przesyłanego pliku
CVE-2025-64090CRITICAL10.0PL ✓ten sam vendor
Command injection w Zenitel TCIS-3 – wykonanie poleceń przez hostname
CVE-2025-64093CRITICAL10.0PL ✓ten sam vendor
RCE poprzez command injection w polu hostname urządzeń Zenitel ICx500/ICx510
CVE-2025-64091HIGH8.6ten sam vendor
This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.
CVE-2025-64092HIGH7.5ten sam vendor
This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and d...