GCVE-1988-2026-0297
Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-08 11:40
VLAI
EPSS
VEX
Title
[KIS-2026-16] Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation Vulnerability
Summary
-------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation
Vulnerability
-------------------------------------------------------------------------------
[-] Software Link:
https://www.teleniasoftware.com
[-] Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
[-] Vulnerability Description:
The vulnerability is caused by an insecure sudoers configuration in the
/etc/sudoers.d/telenia file:
apache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id
apache ALL=NOPASSWD: /usr/sbin/postsuper
apache ALL=NOPASSWD: /bin/nice
apache ALL=NOPASSWD: /usr/bin/hostnamectl
apache ALL=NOPASSWD: /sbin/halt
apache ALL=NOPASSWD: /sbin/reboot
The apache user is allowed to execute the "nice" command with root
privileges without requiring a password. Since "nice" can be abused to
invoke arbitrary commands, this misconfiguration enables an attacker with
access to the apache account to execute arbitrary commands as the root
user, resulting in a Local Privilege Escalation.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[22/05/2026] - Vendor was contacted, no response
[27/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-64829 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-16
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | Telenia Software TVox |
Affected:
unknown
|
guessed |
Relationships
reference
GCVE-1988-2026-0297 (this record)
- related CVE-2026-64829
{
"containers": {
"cna": {
"affected": [
{
"product": "Telenia Software TVox",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-------------------------------------------------------------------------------\nTelenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation\nVulnerability\n-------------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.teleniasoftware.com\n\n\n[-] Affected Versions:\n\nVersion 26.5.3 and prior 26.x versions.\nVersion 24.9.21 and prior 24.x versions.\nOlder versions may be affected as well.\n\n\n[-] Vulnerability Description:\n\nThe vulnerability is caused by an insecure sudoers configuration in the\n/etc/sudoers.d/telenia file:\n\n\napache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id\n\napache ALL=NOPASSWD: /usr/sbin/postsuper\n\napache ALL=NOPASSWD: /bin/nice\napache ALL=NOPASSWD: /usr/bin/hostnamectl\napache ALL=NOPASSWD: /sbin/halt\napache ALL=NOPASSWD: /sbin/reboot\n\n\nThe apache user is allowed to execute the \"nice\" command with root\nprivileges without requiring a password. Since \"nice\" can be abused to\ninvoke arbitrary commands, this misconfiguration enables an attacker with\naccess to the apache account to execute arbitrary commands as the root\nuser, resulting in a Local Privilege Escalation.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/tvox_root_rce.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[22/05/2026] - Vendor was contacted, no response\n[27/05/2026] - Vendor was notified about this vulnerability, no response\n[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,\nno response\n[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no\nresponse from CSIRT\n[08/07/2026] - First vendor response, asking for vulnerability details\n[09/07/2026] - Vulnerability details safely provided to the vendor\n[20/07/2026] - Vendor was contacted again, asking for an update\n[21/07/2026] - Vendor replied a security patch will be released by the end\nof July\n[21/07/2026] - CVE identifier requested\n[21/07/2026] - CVE identifier assigned\n[27/07/2026] - Reached 60-day disclosure deadline, still no official\nsolution\n[03/08/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-64829 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-16\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T11:40:48Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/32"
},
{
"url": "https://karmainsecurity.com/KIS-2026-16"
},
{
"url": "https://karmainsecurity.com/pocs/tvox_root_rce.php"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.teleniasoftware.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/32"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-16] Telenia Software TVox \u003c= 26.5.3 (nice) Local Privilege Escalation Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-64829",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0297",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/32",
"automated": true,
"contentSha256": "6fe3bdfe6e52b71acd1d426aa72052689d91f1538bde6a1175e9fab3479a1984",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/32",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-03T07:30:11Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0297"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T11:40:48Z",
"dateUpdated": "2026-09-08T11:40:48Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0297"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…