Telenia Software
Monthly
Privilege escalation in Telenia Software TVox allows any process running as the apache OS user to obtain full root-level command execution without a password, by exploiting a misconfigured vendor-supplied sudoers entry in /etc/sudoers.d/telenia that grants NOPASSWD execution of /bin/nice. Affected branches are 26.x up to and including 26.5.3, and 24.x up to and including 24.9.21. A public exploit is available via KarmaInsecurity advisory KIS-2026-16; no CISA KEV listing has been confirmed, though the trivial exploitation complexity and available proof-of-concept materially elevate real-world risk for any environment where the TVox web tier is reachable.
OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized `pid` parameter in `action_audio.php`. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the `apache` system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale.
Authentication bypass in Telenia Software TVox (versions 24.x ≤24.9.21 and 26.x ≤26.5.3) lets remote unauthenticated attackers reach every PHP script under the manager HTML directory by appending '/login_admin.php' to any target script's path. The flaw stems from set_env.php trusting the client-controllable PHP_SELF value when deciding whether to skip authentication. Publicly available exploit code exists (KarmaInSecurity KIS-2026-14, reported by VulnCheck), but there is no CISA KEV listing, so treat it as no public active exploitation confirmed despite a ready POC.
Privilege escalation in Telenia Software TVox allows any process running as the apache OS user to obtain full root-level command execution without a password, by exploiting a misconfigured vendor-supplied sudoers entry in /etc/sudoers.d/telenia that grants NOPASSWD execution of /bin/nice. Affected branches are 26.x up to and including 26.5.3, and 24.x up to and including 24.9.21. A public exploit is available via KarmaInsecurity advisory KIS-2026-16; no CISA KEV listing has been confirmed, though the trivial exploitation complexity and available proof-of-concept materially elevate real-world risk for any environment where the TVox web tier is reachable.
OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized `pid` parameter in `action_audio.php`. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the `apache` system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale.
Authentication bypass in Telenia Software TVox (versions 24.x ≤24.9.21 and 26.x ≤26.5.3) lets remote unauthenticated attackers reach every PHP script under the manager HTML directory by appending '/login_admin.php' to any target script's path. The flaw stems from set_env.php trusting the client-controllable PHP_SELF value when deciding whether to skip authentication. Publicly available exploit code exists (KarmaInSecurity KIS-2026-14, reported by VulnCheck), but there is no CISA KEV listing, so treat it as no public active exploitation confirmed despite a ready POC.