CVE-2018-19927: Zenitel IP-Stationweb Firmware

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases.

Affected products

• Zenitel IP-Stationweb Firmware: before 4.2.3.9 (fixed in 4.2.3.9)

Published 2018-12-06. Last modified 2026-06-17.