External risk intelligence

OS Command Injection Vulnerability in Station and Device Firmware Package

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-64127

The vulnerability affects specialized communications hardware and device firmware (VS-IS) that often functions as an edge or network-connected service. Given the potential for remote, unauthenticated command execution in network-facing appliances, such devices are commonly reachable in their intended deployment patterns.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability found in certain application software where insufficient input validation allows an unauthenticated attacker to potentially run commands on the affected system remotely. The primary concern is to confirm if your environment utilizes the affected technology and assess the exposure.

Commands can be run remotely by attackers.
Critical flaw in how some applications handle user input.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could remotely execute arbitrary commands by sending specially crafted input to an application that fails to properly validate parameters used in operating system commands. This vulnerability allows attackers to bypass security controls and gain unauthorized command-line access.

No authentication required.
Input used in OS commands.
Remote command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands remotely on affected systems. When supported by the advisory, this could impact sensitive information, system integrity, and service availability by allowing an attacker to potentially take control of the affected device and its network interactions.

System commands and device configuration.
Unauthenticated remote input injection.
Compromise of device and network.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS command injection vulnerability likely impacts application owners and infrastructure teams responsible for managing network-connected devices. The first practical step is to identify all instances of the affected technology, confirm their external reachability and business criticality, and then locate the accountable owner to plan a risk-based remediation.

Application and infrastructure teams own remediation.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the VS-IS firmware package?

The VS-IS (Station and Device Firmware Package) is specialized software used in Zenitel communications hardware. It powers devices designed for intercom, public address, and emergency messaging functions, serving as the core operating logic that manages how these units handle network-based voice and data communications.

How does CVE-2025-64127 trigger command injection?

This vulnerability, classified as CWE-78 (OS Command Injection), occurs because the software fails to clean user-supplied data before inserting it into system-level commands. Because the system treats this unvalidated input as a legitimate instruction, an attacker can manipulate the input to force the device to execute unauthorized operations.

Do I need to be authenticated to trigger this flaw?

No. This vulnerability is triggered remotely without requiring any login credentials. The bug is specifically activated by sending specially crafted input to the application. It is not triggered by standard, authorized interactions with the device's intended user interface or normal administrative functions.

Is my device at risk if it is not on the internet?

Halo Surface Signal indicates this vulnerability is most concerning for network-connected appliances reachable by remote, unauthenticated parties. While devices isolated on internal networks are less accessible to external attackers, they remain potentially vulnerable if an actor gains access to the internal network segment where the hardware resides.

What is the first step to address this CVE?

Your priority is to inventory your environment to locate all instances of the affected VS-IS firmware. Once identified, evaluate whether those specific devices are reachable from external networks, determine their business importance, and coordinate with the system owners to manage the risk and prepare for updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.