Search
Find a vulnerability
Search criteria
12 vulnerabilities by Telenia Software
GCVE-1988-2026-0295
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-11-02 08:49
VLAI
EPSS
VEX
Title
[KIS-2026-14] Telenia Software TVox <= 26.5.3 (set_env.php) Authentication Bypass Vulnerability
Summary
---------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (set_env.php) Authentication Bypass
Vulnerability
---------------------------------------------------------------------------------
[-] Software Link:
https://www.teleniasoftware.com
[-] Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
[-] Vulnerability Description:
The vulnerable code is located within the
/opt/telenia/tvox/php/siti/t-vox/manager/set_env.php script. Specifically,
into the redirectToLoginAdminIRequestHaveAccessToken() function:
293. function redirectToLoginAdminIRequestHaveAccessToken($force = false) {
294. $current_page = str_replace("/", "", strrchr($_SERVER['PHP_SELF'],
"/"));
295. if ($current_page != "login_admin.php") {
296. $request_uri = $_SERVER["REQUEST_URI"];
297. $accessToken = @trim($force ? $_REQUEST["access_token"] :
$_GET["access_token"]);
298.
299. if ($accessToken !== "" && (!isset($_SESSION["wso2auth"]) || (
isset($_SESSION["wso2auth"]) && $_SESSION["wso2auth"]->accessToken !==
trim($accessToken)) )) {
300. $force = true;
301. if (@trim($_GET["access_token"]) != "") {
302. $parsedUrl = parse_url($request_uri);
303. $parsedUrl["query"] =
query_string_exclude(array('access_token'), $_GET);
304. if ($parsedUrl["query"] != "") {
305. $request_uri = $parsedUrl["path"] . "?" .
$parsedUrl["query"];
306. }
307. }
308. }
309.
310. if ($force) {
311. $_SESSION["request_uri"] = $request_uri;
312. unset($_REQUEST["access_token"]);
313. $_SESSION['requestSave'] = $_REQUEST;
314. header("Location: /tvox/manager/html/login_admin.php" . (
$accessToken === "" ? "" : "?access_token=" . $accessToken ));
315. exit;
316. }
317. }
318. }
This function is invoked to verify whether the user is already
authenticated. If the user is not authenticated, execution reaches line
314, where the user is redirected to the login page, and it terminates at
line 315 via an exit statement. The issue is that this authentication check
is only enforced when the value of the $current_page variable differs from
"login_admin.php" (line 295). Since $current_page is populated using the
value of $_SERVER['PHP_SELF'] (at line 294), an attacker can bypass the
authentication check by simply appending the string "/login_admin.php" to
the path of the target PHP script. As a result, the application incorrectly
treats the request as if it were targeting the login page, allowing
unauthenticated access to all PHP scripts exposed under the
/tvox/manager/html/ path.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[22/05/2026] - Vendor was contacted, no response
[26/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-64827 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-14
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0295 (this record)
- related CVE-2026-64827
{
"containers": {
"cna": {
"affected": [
{
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass\nVulnerability\n---------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/set_env.php script. Specifically,\ninto the redirectToLoginAdminIRequestHaveAccessToken() function:\n\n293. function redirectToLoginAdminIRequestHaveAccessToken($force = false) {\n294. $current_page = str_replace(\"/\", \"\", strrchr($_SERVER[\u0027PHP_SELF\u0027],\n\"/\"));\n295. if ($current_page != \"login_admin.php\") {\n296. $request_uri = $_SERVER[\"REQUEST_URI\"];\n297. $accessToken = @trim($force ? $_REQUEST[\"access_token\"] :\n$_GET[\"access_token\"]);\n298.\n299. if ($accessToken !== \"\" \u0026\u0026 (!isset($_SESSION[\"wso2auth\"]) || (\nisset($_SESSION[\"wso2auth\"]) \u0026\u0026 $_SESSION[\"wso2auth\"]-\u003eaccessToken !==\ntrim($accessToken)) )) {\n300. $force = true;\n301. if (@trim($_GET[\"access_token\"]) != \"\") {\n302. $parsedUrl = parse_url($request_uri);\n303. $parsedUrl[\"query\"] =\nquery_string_exclude(array(\u0027access_token\u0027), $_GET);\n304. if ($parsedUrl[\"query\"] != \"\") {\n305. $request_uri = $parsedUrl[\"path\"] . \"?\" .\n$parsedUrl[\"query\"];\n306. }\n307. }\n308. }\n309.\n310. if ($force) {\n311. $_SESSION[\"request_uri\"] = $request_uri;\n312. unset($_REQUEST[\"access_token\"]);\n313. $_SESSION[\u0027requestSave\u0027] = $_REQUEST;\n314. header(\"Location: /tvox/manager/html/login_admin.php\" . (\n$accessToken === \"\" ? \"\" : \"?access_token=\" . $accessToken ));\n315. exit;\n316. }\n317. }\n318. }\n\nThis function is invoked to verify whether the user is already\nauthenticated. If the user is not authenticated, execution reaches line\n314, where the user is redirected to the login page, and it terminates at\nline 315 via an exit statement. The issue is that this authentication check\nis only enforced when the value of the $current_page variable differs from\n\"login_admin.php\" (line 295). Since $current_page is populated using the\nvalue of $_SERVER[\u0027PHP_SELF\u0027] (at line 294), an attacker can bypass the\nauthentication check by simply appending the string \"/login_admin.php\" to\nthe path of the target PHP script. As a result, the application incorrectly\ntreats the request as if it were targeting the login page, allowing\nunauthenticated access to all PHP scripts exposed under the\n/tvox/manager/html/ path.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64827 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-14\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T08:49:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/30"
},
{
"url": "https://karmainsecurity.com/KIS-2026-14"
},
{
"url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.teleniasoftware.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/30"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-14] Telenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-64827",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0295",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30",
"automated": true,
"contentSha256": "db796cc3baba52f714319d385500cac70859e39161a1b0031005a3f55d87eb2a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/30",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T07:28:02Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0295"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:48Z",
"dateUpdated": "2026-11-02T08:49:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0295"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0296
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-11-02 08:49
VLAI
EPSS
VEX
Title
[KIS-2026-15] Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection Vulnerability
Summary
-------------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection
Vulnerability
-------------------------------------------------------------------------------------
[-] Software Link:
https://www.teleniasoftware.com
[-] Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
[-] Vulnerability Description:
The vulnerable code is located within the
/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:
180. case "checkProcess":
181. $pid = @trim($_REQUEST["pid"]);
182. $logFile = @trim($_REQUEST["logFile"]);
183. if ($pid != "")
184. exec('ps -p ' . $_REQUEST["pid"], $output);
User input passed through the "pid" request parameter (when the "action"
request parameter is set to "checkProcess") is not properly sanitized
before being used to execute OS commands via an exec() call at line 184.
This can be exploited to inject and execute arbitrary OS commands with the
privileges of the "apache" user on the web server.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[22/05/2026] - Vendor was contacted, no response
[26/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-64828 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-15
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0296 (this record)
- related CVE-2026-64828
{
"containers": {
"cna": {
"affected": [
{
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-------------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection\nVulnerability\n-------------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:\n\n180. case \"checkProcess\":\n181. $pid = @trim($_REQUEST[\"pid\"]);\n182. $logFile = @trim($_REQUEST[\"logFile\"]);\n183. if ($pid != \"\")\n184. exec(\u0027ps -p \u0027 . $_REQUEST[\"pid\"], $output);\n\nUser input passed through the \"pid\" request parameter (when the \"action\"\nrequest parameter is set to \"checkProcess\") is not properly sanitized\nbefore being used to execute OS commands via an exec() call at line 184.\nThis can be exploited to inject and execute arbitrary OS commands with the\nprivileges of the \"apache\" user on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64828 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-15\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T08:49:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/31"
},
{
"url": "https://karmainsecurity.com/KIS-2026-15"
},
{
"url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.teleniasoftware.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/31"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-15] Telenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-64828",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0296",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31",
"automated": true,
"contentSha256": "750a1c9853cbaf029db7a8361d781a98c8c41779467bc804c2ba737e24db81ff",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/31",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T07:29:12Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0296"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:48Z",
"dateUpdated": "2026-11-02T08:49:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0296"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0297
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-11-02 08:49
VLAI
EPSS
VEX
Title
[KIS-2026-16] Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation Vulnerability
Summary
-------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation
Vulnerability
-------------------------------------------------------------------------------
[-] Software Link:
https://www.teleniasoftware.com
[-] Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
[-] Vulnerability Description:
The vulnerability is caused by an insecure sudoers configuration in the
/etc/sudoers.d/telenia file:
apache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id
apache ALL=NOPASSWD: /usr/sbin/postsuper
apache ALL=NOPASSWD: /bin/nice
apache ALL=NOPASSWD: /usr/bin/hostnamectl
apache ALL=NOPASSWD: /sbin/halt
apache ALL=NOPASSWD: /sbin/reboot
The apache user is allowed to execute the "nice" command with root
privileges without requiring a password. Since "nice" can be abused to
invoke arbitrary commands, this misconfiguration enables an attacker with
access to the apache account to execute arbitrary commands as the root
user, resulting in a Local Privilege Escalation.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[22/05/2026] - Vendor was contacted, no response
[27/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-64829 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-16
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0297 (this record)
- related CVE-2026-64829
{
"containers": {
"cna": {
"affected": [
{
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation\nVulnerability\n-------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerability is caused by an insecure sudoers configuration in the\n/etc/sudoers.d/telenia file:\n\n\napache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id\n\napache ALL=NOPASSWD: /usr/sbin/postsuper\n\napache ALL=NOPASSWD: /bin/nice\napache ALL=NOPASSWD: /usr/bin/hostnamectl\napache ALL=NOPASSWD: /sbin/halt\napache ALL=NOPASSWD: /sbin/reboot\n\n\nThe apache user is allowed to execute the \"nice\" command with root\nprivileges without requiring a password. Since \"nice\" can be abused to\ninvoke arbitrary commands, this misconfiguration enables an attacker with\naccess to the apache account to execute arbitrary commands as the root\nuser, resulting in a Local Privilege Escalation.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[27/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64829 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-16\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T08:49:27Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/32"
},
{
"url": "https://karmainsecurity.com/KIS-2026-16"
},
{
"url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.teleniasoftware.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/32"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-16] Telenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-64829",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0297",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32",
"automated": true,
"contentSha256": "6fe3bdfe6e52b71acd1d426aa72052689d91f1538bde6a1175e9fab3479a1984",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/32",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T07:30:11Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0297"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:48Z",
"dateUpdated": "2026-11-02T08:49:27Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0297"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0062
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-11-02 08:49
VLAI
EPSS
VEX
Title
[KIS-2026-15] Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection Vulnerability
Summary
-------------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection
Vulnerability
-------------------------------------------------------------------------------------
[-] Software Link:
https://www.teleniasoftware.com
[-] Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
[-] Vulnerability Description:
The vulnerable code is located within the
/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:
180. case "checkProcess":
181. $pid = @trim($_REQUEST["pid"]);
182. $logFile = @trim($_REQUEST["logFile"]);
183. if ($pid != "")
184. exec('ps -p ' . $_REQUEST["pid"], $output);
User input passed through the "pid" request parameter (when the "action"
request parameter is set to "checkProcess") is not properly sanitized
before being used to execute OS commands via an exec() call at line 184.
This can be exploited to inject and execute arbitrary OS commands with the
privileges of the "apache" user on the web server.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[22/05/2026] - Vendor was contacted, no response
[26/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-64828 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-15
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-------------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection\nVulnerability\n-------------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:\n\n180. case \"checkProcess\":\n181. $pid = @trim($_REQUEST[\"pid\"]);\n182. $logFile = @trim($_REQUEST[\"logFile\"]);\n183. if ($pid != \"\")\n184. exec(\u0027ps -p \u0027 . $_REQUEST[\"pid\"], $output);\n\nUser input passed through the \"pid\" request parameter (when the \"action\"\nrequest parameter is set to \"checkProcess\") is not properly sanitized\nbefore being used to execute OS commands via an exec() call at line 184.\nThis can be exploited to inject and execute arbitrary OS commands with the\nprivileges of the \"apache\" user on the web server.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64828 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-15\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T08:49:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/31"
},
{
"url": "https://karmainsecurity.com/KIS-2026-15"
},
{
"url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.teleniasoftware.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/31"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-15] Telenia Software TVox \u003c= 26.5.3 (action_audio.php) OS Command Injection Vulnerability",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0062",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/31",
"automated": true,
"contentSha256": "750a1c9853cbaf029db7a8361d781a98c8c41779467bc804c2ba737e24db81ff",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/31",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T07:29:12Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-11-02T08:49:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0062"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0063
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-11-02 08:49
VLAI
EPSS
VEX
Title
[KIS-2026-16] Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation Vulnerability
Summary
-------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation
Vulnerability
-------------------------------------------------------------------------------
[-] Software Link:
https://www.teleniasoftware.com
[-] Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
[-] Vulnerability Description:
The vulnerability is caused by an insecure sudoers configuration in the
/etc/sudoers.d/telenia file:
apache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id
apache ALL=NOPASSWD: /usr/sbin/postsuper
apache ALL=NOPASSWD: /bin/nice
apache ALL=NOPASSWD: /usr/bin/hostnamectl
apache ALL=NOPASSWD: /sbin/halt
apache ALL=NOPASSWD: /sbin/reboot
The apache user is allowed to execute the "nice" command with root
privileges without requiring a password. Since "nice" can be abused to
invoke arbitrary commands, this misconfiguration enables an attacker with
access to the apache account to execute arbitrary commands as the root
user, resulting in a Local Privilege Escalation.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[22/05/2026] - Vendor was contacted, no response
[27/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-64829 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-16
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation\nVulnerability\n-------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerability is caused by an insecure sudoers configuration in the\n/etc/sudoers.d/telenia file:\n\n\napache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id\n\napache ALL=NOPASSWD: /usr/sbin/postsuper\n\napache ALL=NOPASSWD: /bin/nice\napache ALL=NOPASSWD: /usr/bin/hostnamectl\napache ALL=NOPASSWD: /sbin/halt\napache ALL=NOPASSWD: /sbin/reboot\n\n\nThe apache user is allowed to execute the \"nice\" command with root\nprivileges without requiring a password. Since \"nice\" can be abused to\ninvoke arbitrary commands, this misconfiguration enables an attacker with\naccess to the apache account to execute arbitrary commands as the root\nuser, resulting in a Local Privilege Escalation.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[27/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64829 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-16\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T08:49:27Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/32"
},
{
"url": "https://karmainsecurity.com/KIS-2026-16"
},
{
"url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.teleniasoftware.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/32"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-16] Telenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation Vulnerability",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0063",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32",
"automated": true,
"contentSha256": "6fe3bdfe6e52b71acd1d426aa72052689d91f1538bde6a1175e9fab3479a1984",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/32",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T07:30:11Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-11-02T08:49:27Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0063"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0061
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-11-02 08:49
VLAI
EPSS
VEX
Title
[KIS-2026-14] Telenia Software TVox <= 26.5.3 (set_env.php) Authentication Bypass Vulnerability
Summary
---------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (set_env.php) Authentication Bypass
Vulnerability
---------------------------------------------------------------------------------
[-] Software Link:
https://www.teleniasoftware.com
[-] Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
[-] Vulnerability Description:
The vulnerable code is located within the
/opt/telenia/tvox/php/siti/t-vox/manager/set_env.php script. Specifically,
into the redirectToLoginAdminIRequestHaveAccessToken() function:
293. function redirectToLoginAdminIRequestHaveAccessToken($force = false) {
294. $current_page = str_replace("/", "", strrchr($_SERVER['PHP_SELF'],
"/"));
295. if ($current_page != "login_admin.php") {
296. $request_uri = $_SERVER["REQUEST_URI"];
297. $accessToken = @trim($force ? $_REQUEST["access_token"] :
$_GET["access_token"]);
298.
299. if ($accessToken !== "" && (!isset($_SESSION["wso2auth"]) || (
isset($_SESSION["wso2auth"]) && $_SESSION["wso2auth"]->accessToken !==
trim($accessToken)) )) {
300. $force = true;
301. if (@trim($_GET["access_token"]) != "") {
302. $parsedUrl = parse_url($request_uri);
303. $parsedUrl["query"] =
query_string_exclude(array('access_token'), $_GET);
304. if ($parsedUrl["query"] != "") {
305. $request_uri = $parsedUrl["path"] . "?" .
$parsedUrl["query"];
306. }
307. }
308. }
309.
310. if ($force) {
311. $_SESSION["request_uri"] = $request_uri;
312. unset($_REQUEST["access_token"]);
313. $_SESSION['requestSave'] = $_REQUEST;
314. header("Location: /tvox/manager/html/login_admin.php" . (
$accessToken === "" ? "" : "?access_token=" . $accessToken ));
315. exit;
316. }
317. }
318. }
This function is invoked to verify whether the user is already
authenticated. If the user is not authenticated, execution reaches line
314, where the user is redirected to the login page, and it terminates at
line 315 via an exit statement. The issue is that this authentication check
is only enforced when the value of the $current_page variable differs from
"login_admin.php" (line 295). Since $current_page is populated using the
value of $_SERVER['PHP_SELF'] (at line 294), an attacker can bypass the
authentication check by simply appending the string "/login_admin.php" to
the path of the target PHP script. As a result, the application incorrectly
treats the request as if it were targeting the login page, allowing
unauthenticated access to all PHP scripts exposed under the
/tvox/manager/html/ path.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[22/05/2026] - Vendor was contacted, no response
[26/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-64827 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-14
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "---------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass\nVulnerability\n---------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located within the\n/opt/telenia/tvox/php/siti/t-vox/manager/set_env.php script. Specifically,\ninto the redirectToLoginAdminIRequestHaveAccessToken() function:\n\n293. function redirectToLoginAdminIRequestHaveAccessToken($force = false) {\n294. $current_page = str_replace(\"/\", \"\", strrchr($_SERVER[\u0027PHP_SELF\u0027],\n\"/\"));\n295. if ($current_page != \"login_admin.php\") {\n296. $request_uri = $_SERVER[\"REQUEST_URI\"];\n297. $accessToken = @trim($force ? $_REQUEST[\"access_token\"] :\n$_GET[\"access_token\"]);\n298.\n299. if ($accessToken !== \"\" \u0026\u0026 (!isset($_SESSION[\"wso2auth\"]) || (\nisset($_SESSION[\"wso2auth\"]) \u0026\u0026 $_SESSION[\"wso2auth\"]-\u003eaccessToken !==\ntrim($accessToken)) )) {\n300. $force = true;\n301. if (@trim($_GET[\"access_token\"]) != \"\") {\n302. $parsedUrl = parse_url($request_uri);\n303. $parsedUrl[\"query\"] =\nquery_string_exclude(array(\u0027access_token\u0027), $_GET);\n304. if ($parsedUrl[\"query\"] != \"\") {\n305. $request_uri = $parsedUrl[\"path\"] . \"?\" .\n$parsedUrl[\"query\"];\n306. }\n307. }\n308. }\n309.\n310. if ($force) {\n311. $_SESSION[\"request_uri\"] = $request_uri;\n312. unset($_REQUEST[\"access_token\"]);\n313. $_SESSION[\u0027requestSave\u0027] = $_REQUEST;\n314. header(\"Location: /tvox/manager/html/login_admin.php\" . (\n$accessToken === \"\" ? \"\" : \"?access_token=\" . $accessToken ));\n315. exit;\n316. }\n317. }\n318. }\n\nThis function is invoked to verify whether the user is already\nauthenticated. If the user is not authenticated, execution reaches line\n314, where the user is redirected to the login page, and it terminates at\nline 315 via an exit statement. The issue is that this authentication check\nis only enforced when the value of the $current_page variable differs from\n\"login_admin.php\" (line 295). Since $current_page is populated using the\nvalue of $_SERVER[\u0027PHP_SELF\u0027] (at line 294), an attacker can bypass the\nauthentication check by simply appending the string \"/login_admin.php\" to\nthe path of the target PHP script. As a result, the application incorrectly\ntreats the request as if it were targeting the login page, allowing\nunauthenticated access to all PHP scripts exposed under the\n/tvox/manager/html/ path.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[26/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64827 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-14\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T08:49:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/30"
},
{
"url": "https://karmainsecurity.com/KIS-2026-14"
},
{
"url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.teleniasoftware.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/30"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-14] Telenia Software TVox \u003c= 26.5.3 (set_env.php) Authentication Bypass Vulnerability",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0061",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/30",
"automated": true,
"contentSha256": "db796cc3baba52f714319d385500cac70859e39161a1b0031005a3f55d87eb2a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/30",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T07:28:02Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-11-02T08:49:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0061"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67609 (GCVE-0-2026-67609)
Vulnerability from nvd – Published: 2026-08-03 13:32 – Updated: 2026-08-03 16:31
VLAI
EPSS
VEX
Title
Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
Summary
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:40 UTC
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-16 | technical-descriptionexploit |
| https://www.teleniasoftware.com/ | product |
| https://www.vulncheck.com/advisories/telenia-tvox… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
26.0.0 , ≤ 26.5.3
(semver)
Affected: 24.0.0 , ≤ 24.9.21 (semver) |
Date Public
2026-08-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67609",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:40:43.557512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:40:56.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"lessThanOrEqual": "26.5.3",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-08-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:31:57.398Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(in)Security Disclosure (KIS-2026-16)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-16"
},
{
"name": "Supplier Homepage",
"tags": [
"product"
],
"url": "https://www.teleniasoftware.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/telenia-tvox-privilege-escalation-via-insecure-sudoers-configuration"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67609",
"datePublished": "2026-08-03T13:32:37.413Z",
"dateReserved": "2026-07-29T21:07:39.202Z",
"dateUpdated": "2026-08-03T16:31:57.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67608 (GCVE-0-2026-67608)
Vulnerability from nvd – Published: 2026-08-03 13:30 – Updated: 2026-08-03 16:31
VLAI
EPSS
VEX
Title
Telenia TVox 26.5.3 OS Command Injection via action_audio.php
Summary
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:41 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-15 | technical-descriptionexploit |
| https://www.teleniasoftware.com/ | product |
| https://www.vulncheck.com/advisories/telenia-tvox… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
26.0.0 , ≤ 26.5.3
(semver)
Affected: 24.0.0 , ≤ 24.9.21 (semver) |
Date Public
2026-08-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67608",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:41:16.763310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:41:26.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"lessThanOrEqual": "26.5.3",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-08-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:31:34.083Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(in)Security Disclosure (KIS-2026-15)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-15"
},
{
"name": "Supplier Homepage",
"tags": [
"product"
],
"url": "https://www.teleniasoftware.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Telenia TVox 26.5.3 OS Command Injection via action_audio.php",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67608",
"datePublished": "2026-08-03T13:30:35.442Z",
"dateReserved": "2026-07-29T21:07:39.202Z",
"dateUpdated": "2026-08-03T16:31:34.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64827 (GCVE-0-2026-64827)
Vulnerability from nvd – Published: 2026-08-03 13:26 – Updated: 2026-08-07 05:32
VLAI
EPSS
VEX
Title
Telenia TVox 26.5.3 Authentication Bypass via set_env.php
Summary
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:27 UTC
CWE
- CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-14 | technical-descriptionexploit |
| https://www.teleniasoftware.com/ | product |
| https://www.vulncheck.com/advisories/telenia-tvox… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Aug/30 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
26.0.0 , ≤ 26.5.3
(semver)
Affected: 24.0.0 , ≤ 24.9.21 (semver) |
Date Public
2026-08-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64827",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:27:45.340772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:27:52.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-08-07T05:32:23.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Aug/30"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"lessThanOrEqual": "26.5.3",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-08-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches \u0027login_admin.php\u0027. Attackers can append \u0027/login_admin.php\u0027 to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T13:26:10.363Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(in)Security Disclosure (KIS-2026-14)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-14"
},
{
"name": "Supplier Homepage",
"tags": [
"product"
],
"url": "https://www.teleniasoftware.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/telenia-tvox-authentication-bypass-via-set-env-php"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Telenia TVox 26.5.3 Authentication Bypass via set_env.php",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-64827",
"datePublished": "2026-08-03T13:26:10.363Z",
"dateReserved": "2026-07-20T18:27:48.161Z",
"dateUpdated": "2026-08-07T05:32:23.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67609 (GCVE-0-2026-67609)
Vulnerability from cvelistv5 – Published: 2026-08-03 13:32 – Updated: 2026-08-03 16:31
VLAI
EPSS
VEX
Title
Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
Summary
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:40 UTC
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-16 | technical-descriptionexploit |
| https://www.teleniasoftware.com/ | product |
| https://www.vulncheck.com/advisories/telenia-tvox… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
26.0.0 , ≤ 26.5.3
(semver)
Affected: 24.0.0 , ≤ 24.9.21 (semver) |
Date Public
2026-08-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67609",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:40:43.557512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:40:56.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"lessThanOrEqual": "26.5.3",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-08-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:31:57.398Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(in)Security Disclosure (KIS-2026-16)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-16"
},
{
"name": "Supplier Homepage",
"tags": [
"product"
],
"url": "https://www.teleniasoftware.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/telenia-tvox-privilege-escalation-via-insecure-sudoers-configuration"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67609",
"datePublished": "2026-08-03T13:32:37.413Z",
"dateReserved": "2026-07-29T21:07:39.202Z",
"dateUpdated": "2026-08-03T16:31:57.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67608 (GCVE-0-2026-67608)
Vulnerability from cvelistv5 – Published: 2026-08-03 13:30 – Updated: 2026-08-03 16:31
VLAI
EPSS
VEX
Title
Telenia TVox 26.5.3 OS Command Injection via action_audio.php
Summary
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:41 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-15 | technical-descriptionexploit |
| https://www.teleniasoftware.com/ | product |
| https://www.vulncheck.com/advisories/telenia-tvox… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
26.0.0 , ≤ 26.5.3
(semver)
Affected: 24.0.0 , ≤ 24.9.21 (semver) |
Date Public
2026-08-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67608",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:41:16.763310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:41:26.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"lessThanOrEqual": "26.5.3",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-08-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:31:34.083Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(in)Security Disclosure (KIS-2026-15)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-15"
},
{
"name": "Supplier Homepage",
"tags": [
"product"
],
"url": "https://www.teleniasoftware.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Telenia TVox 26.5.3 OS Command Injection via action_audio.php",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67608",
"datePublished": "2026-08-03T13:30:35.442Z",
"dateReserved": "2026-07-29T21:07:39.202Z",
"dateUpdated": "2026-08-03T16:31:34.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64827 (GCVE-0-2026-64827)
Vulnerability from cvelistv5 – Published: 2026-08-03 13:26 – Updated: 2026-08-07 05:32
VLAI
EPSS
VEX
Title
Telenia TVox 26.5.3 Authentication Bypass via set_env.php
Summary
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:27 UTC
CWE
- CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-14 | technical-descriptionexploit |
| https://www.teleniasoftware.com/ | product |
| https://www.vulncheck.com/advisories/telenia-tvox… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Aug/30 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Telenia Software | TVox |
Affected:
26.0.0 , ≤ 26.5.3
(semver)
Affected: 24.0.0 , ≤ 24.9.21 (semver) |
Date Public
2026-08-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64827",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:27:45.340772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:27:52.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-08-07T05:32:23.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Aug/30"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "TVox",
"vendor": "Telenia Software",
"versions": [
{
"lessThanOrEqual": "26.5.3",
"status": "affected",
"version": "26.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-08-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches \u0027login_admin.php\u0027. Attackers can append \u0027/login_admin.php\u0027 to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T13:26:10.363Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Karma(in)Security Disclosure (KIS-2026-14)",
"tags": [
"technical-description",
"exploit"
],
"url": "https://karmainsecurity.com/KIS-2026-14"
},
{
"name": "Supplier Homepage",
"tags": [
"product"
],
"url": "https://www.teleniasoftware.com/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/telenia-tvox-authentication-bypass-via-set-env-php"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Telenia TVox 26.5.3 Authentication Bypass via set_env.php",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-64827",
"datePublished": "2026-08-03T13:26:10.363Z",
"dateReserved": "2026-07-20T18:27:48.161Z",
"dateUpdated": "2026-08-07T05:32:23.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}