# CVE-2026-95377: OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning

Status: published. Published: 2026-11-13. Updated: 2026-11-13.

OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.



The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.

## Remediation

- fix: Affected devices should upgrade to version 9.6.3.0 (and newer) or 10.1.3.0 (and newer) depending on environment. (source: CNA: Zenitel)

## Affected products and versions

- Zenitel / VSFF6 (EdgeAudioClient): ≥ 0; < 9.6.3.0 (affected, custom); ≥ 10.0.0.0; < 10.1.3.0 (affected, custom). Source: CNA: Zenitel; platforms: Linux, ARM, 32 bit
- Zenitel / VSFF8 (EdgeAudioClient): ≥ 0; < 9.6.3.0 (affected, custom); ≥ 10.0.0.0; < 10.1.3.0 (affected, custom). Source: CNA: Zenitel; platforms: Linux, ARM, 64 bit
- Zenitel / VSFF8MP (EdgeAudioClient): ≥ 0; < 9.6.3.0 (affected, custom); ≥ 10.0.0.0; < 10.1.3.0 (affected, custom). Source: CNA: Zenitel; platforms: Linux, ARM, 64 bit
- Zenitel / VSFF8MN (EdgeAudioClient): ≥ 0; < 9.6.3.0 (affected, custom); ≥ 10.0.0.0; < 10.1.3.0 (affected, custom). Source: CNA: Zenitel; platforms: Linux, ARM, 64 bit
- Zenitel / VSFT (EdgeAudioClient): ≥ 0; < 9.6.3.0 (affected, custom); ≥ 10.0.0.0; < 10.1.3.0 (affected, custom). Source: CNA: Zenitel; platforms: Linux, ARM, 32 bit

## Severity and prioritization

- CVSS 4.0: 9.4 (critical); CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y; source: CNA: Zenitel

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-78

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf (CNA: Zenitel)

## Provenance

- CNA: Zenitel: https://www.cve.org/CVERecord?id=CVE-2026-95377; retrieved 2026-11-13; source updated 2026-11-13

Revision: 9dc8995abb9d6d9b7a41edf044ddf8019cb14aae4bf422aebc96b2fe79f19b5f

Canonical: https://y2.dev/cve/CVE-2026-95377

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.