CVE-2025-59818 is an OS command injection flaw in Zenitel TCIS-3 firmware, scored CVSS 10.0 in the NVD record. An authenticated attacker can run commands by using the file name of an uploaded file. Zenitel fixed it in VS-IS 9.3.3.0, or 8.2.3.4 for TCIV.
What's affected
The NVD record lists the Zenitel TCIS-3 and its firmware. Zenitel's security advisory, dated 19 December 2025, says CVE-2025-59818 is resolved in VS-IS 9.3.3.0, and in 8.2.3.4 for TCIV. The advisory also says that with unpatched firmware, an authenticated user with administrative access to the affected devices may be able to abuse the issue.
That note matters for scoring. The NVD score is 10.0, but the vendor's description points to an authenticated, administrative attacker, so the real risk depends on who holds admin accounts on your devices. The advisory lists a family of CVEs fixed in the same firmware, so updating helps with several.
How to check if you're exposed
Check the firmware version on each Zenitel device through its management interface or your device management tool. Compare it with VS-IS 9.3.3.0 for the standard line, or 8.2.3.4 for TCIV. Zenitel's later releases include 9.3.3.1, which carries further security updates for related CVEs, so aim for the newest build in your line.
Then review who has admin credentials on the devices, and whether the management interface is reachable from outside the management network. Intercom and door station devices are often left on flat networks.
What to do now
- List every Zenitel device and its firmware version.
- Upgrade to VS-IS 9.3.3.1 or the latest release in your line. At minimum use 9.3.3.0, or 8.2.3.4 for TCIV.
- Change administrator passwords and remove default or shared credentials.
- Put device management on a separate VLAN with access limited to administrators.
- Disable file upload features you do not use, if the device allows.
- Keep the advisory and your firmware inventory together, for the next review.
Why it matters
The class is CWE-77, improper neutralization of special elements used in a command. The device used the name of an uploaded file inside a system command. File names look harmless and are often trusted, yet they are input from a user like any other, and a crafted name can change what the command does.
An intercom or access device sits close to physical security, so code execution on it can matter well beyond the network. The fix is on the vendor side, but the defence you control is account hygiene and network separation, which turn a critical flaw that needs admin rights into one few people can reach. The KEV flag is false.
Quick check
Does the attacker need to sign in?
Yes. The description says authenticated attackers, and the vendor advisory refers to a user with administrative access.
Sources
Last reviewed: 19 October 2026.
