{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59814", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "state": "PUBLISHED", "assignerShortName": "NCSC-NL", "dateReserved": "2025-09-22T10:23:28.574Z", "datePublished": "2025-09-25T19:29:34.809Z", "dateUpdated": "2025-09-29T17:25:33.798Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2025-09-26T05:46:25.019Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "title": "Unauthenticated SQL-injection in password field", "affected": [{"vendor": "Zenitel", "product": "ICX500", "versions": [{"version": "<1.4.3.3", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zenitel", "product": "ICX510", "versions": [{"version": "<1.4.3.3", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database."}], "references": [{"url": "https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes", "name": "Zenitel", "tags": ["release-notes"]}, {"url": "https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System", "name": "Zenitel", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "ADJACENT_NETWORK", "modifiedAttackComplexity": "LOW", "modifiedPrivilegesRequired": "NONE", "modifiedUserInteraction": "NONE", "modifiedScope": "UNCHANGED", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedAvailabilityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-29T17:25:21.899215Z", "id": "CVE-2025-59814", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T17:25:33.798Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59814", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-29T17:25:21.899215Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T17:25:30.266Z"}}], "cna": {"title": "Unauthenticated SQL-injection in password field", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "modifiedScope": "UNCHANGED", "temporalScore": 8.8, "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 8.8, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "ADJACENT_NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "NONE", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zenitel", "product": "ICX500", "versions": [{"status": "affected", "version": "<1.4.3.3", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Zenitel", "product": "ICX510", "versions": [{"status": "affected", "version": "<1.4.3.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes", "name": "Zenitel", "tags": ["release-notes"]}, {"url": "https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System", "name": "Zenitel", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2025-09-26T05:46:25.019Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59814", "state": "PUBLISHED", "dateUpdated": "2025-09-29T17:25:33.798Z", "dateReserved": "2025-09-22T10:23:28.574Z", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "datePublished": "2025-09-25T19:29:34.809Z", "assignerShortName": "NCSC-NL"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read the entire contents of the Billing Admin database."}], "id": "CVE-2025-59814", "lastModified": "2025-09-26T14:32:19.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}]}, "published": "2025-09-25T20:15:35.357", "references": [{"source": "[email protected]", "url": "https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System"}, {"source": "[email protected]", "url": "https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "[email protected]", "type": "Secondary"}]}

{}