[KIS-2026-15] Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection Vulnerability

[Egidio Romano <n0b0d13s () gmail com>]

-------------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (action_audio.php) OS Command Injection
Vulnerability
-------------------------------------------------------------------------------------


[-] Software Link:

https://www.teleniasoftware.com


[-] Affected Versions:

Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.


[-] Vulnerability Description:

The vulnerable code is located within the
/opt/telenia/tvox/php/siti/t-vox/manager/html/action_audio.php script:

180.    case "checkProcess":
181.        $pid = @trim($_REQUEST["pid"]);
182.        $logFile = @trim($_REQUEST["logFile"]);
183.        if ($pid != "")
184.            exec('ps -p ' . $_REQUEST["pid"], $output);

User input passed through the "pid" request parameter (when the "action"
request parameter is set to "checkProcess") is not properly sanitized
before being used to execute OS commands via an exec() call at line 184.
This can be exploited to inject and execute arbitrary OS commands with the
privileges of the "apache" user on the web server.


[-] Proof of Concept:

https://karmainsecurity.com/pocs/tvox_root_rce.php


[-] Solution:

No official solution is currently available.


[-] Disclosure Timeline:

[22/05/2026] - Vendor was contacted, no response
[26/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure


[-] CVE Reference:

CVE-2026-64828 has been assigned to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

https://karmainsecurity.com/KIS-2026-15
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/