CVE-2025-64093 is a command injection flaw in Zenitel ICX500 and ICX510 devices, scored CVSS 10.0. Unauthenticated attackers can inject commands through the device hostname. Zenitel's advisory lists it as resolved in ICX-AlphaCom v1.5.3.3, so update the firmware.
What's affected
The NVD record lists the Zenitel ICX500 and ICX510 and their firmware. The weakness is CWE-77. Zenitel's security advisory A100K12333, dated 19 December 2025, lists CVE-2025-64093 as resolved in ICX-AlphaCom v1.5.3.3, and for the AlphaCom XE line in version 13.1.3.16 and BSP 32.4.3.12.
The same advisory covers a family of other CVEs across VS-IS devices, ICX-AlphaCom and AlphaCom XE. A related but different record, CVE-2025-64090, concerns an authenticated command execution through the hostname configuration on other firmware, and Zenitel fixed it in VS-IS 9.3.3.1.
How to check if you're exposed
Read the firmware version on each ICX500 and ICX510 from its management interface or your device management tool. If it is below ICX-AlphaCom v1.5.3.3, you should upgrade. For AlphaCom XE systems, compare with the versions the advisory names.
Then check where the device sits. Because the record says no sign in is needed, network reachability is the main factor. See whether the device's management interface can be reached from outside the intercom or operations network.
What to do now
- Inventory ICX500 and ICX510 devices and their firmware versions.
- Upgrade to ICX-AlphaCom v1.5.3.3 or later, or the matching AlphaCom XE release in the advisory.
- Move device management to an isolated VLAN with firewall rules that allow only administrators.
- Make sure intercom devices are not reachable from the internet.
- Review other Zenitel devices on your network against the same advisory.
Why it matters
The class is CWE-77, improper neutralization of special elements used in a command. The hostname field is a short string that users and administrators set, and the device used it in a way that let extra command text pass through. That the flaw needs no sign in is what gives it the top score.
Intercom and access devices tie into physical security, so a compromised one can reveal audio and open paths into the network. The fixes are firmware updates from the vendor, and the compensating control is isolation. The KEV flag is false.
Quick check
Does the attacker need to sign in?
No. The record says unauthenticated attackers can inject commands into the device hostname.
Sources
Last reviewed: 19 October 2026.
