Skip to content
Fencer Intel
high 7.0

CVE-2026-95379 json

Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root

published yesterday modified yesterday also EUVD-2026-125522

cvss
7.0
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.

This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.

Patch / fix

  • Zenitel VSFF6 10.1.3.0
  • Zenitel VSFF8 10.1.3.0
  • Zenitel VSFF8MP 10.1.3.0
  • Zenitel VSFF8MN 10.1.3.0
  • Zenitel VSFT 10.1.3.0

Is CVE-2026-95379 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
yesterday

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/S:P
CNA 4.0 7.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Zenitel VSFF6
  • Zenitel VSFF8
  • Zenitel VSFF8MP
  • Zenitel VSFF8MN
  • Zenitel VSFT

Classification

Weakness
  • CWE-23 Relative Path Traversal

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.