Description
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
Published: 2026-11-13
Score: 5.1 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to version 1.11.0

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 13 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Description The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
Title Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction
Weaknesses CWE-1021
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Zenitel

Published:

Updated: 2026-11-13T20:04:30.941Z

Reserved: 2026-10-05T16:31:07.433Z

Link: CVE-2026-105625

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-13T16:17:23.227

Modified: 2026-11-13T20:17:42.100

Link: CVE-2026-105625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses