Dashboard / CVE-2026-95614

CVE-2026-95614

CRITICAL
INFO Priority: 0.00 BB Relevance: 39/100
Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: High
UI: None
S: X
AT: None
VC: High
VI: High
VA: High

Description

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
Zenitel Zenitel Connect 0 < 1.11.0

References & Advisories (1)

Bug Bounty Relevance

39 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

9.3 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

No EPSS data available

Intelligence Sources

mitre ref →
nvd ref →

External Links