[KIS-2026-16] Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation Vulnerability

[Egidio Romano <n0b0d13s () gmail com>]

-------------------------------------------------------------------------------
Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation
Vulnerability
-------------------------------------------------------------------------------


[-] Software Link:

https://www.teleniasoftware.com


[-] Affected Versions:

Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.


[-] Vulnerability Description:

The vulnerability is caused by an insecure sudoers configuration in the
/etc/sudoers.d/telenia file:


apache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id

apache ALL=NOPASSWD: /usr/sbin/postsuper

apache ALL=NOPASSWD: /bin/nice
apache ALL=NOPASSWD: /usr/bin/hostnamectl
apache ALL=NOPASSWD: /sbin/halt
apache ALL=NOPASSWD: /sbin/reboot


The apache user is allowed to execute the "nice" command with root
privileges without requiring a password. Since "nice" can be abused to
invoke arbitrary commands, this misconfiguration enables an attacker with
access to the apache account to execute arbitrary commands as the root
user, resulting in a Local Privilege Escalation.


[-] Proof of Concept:

https://karmainsecurity.com/pocs/tvox_root_rce.php


[-] Solution:

No official solution is currently available.


[-] Disclosure Timeline:

[22/05/2026] - Vendor was contacted, no response
[27/05/2026] - Vendor was notified about this vulnerability, no response
[27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
no response
[26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
response from CSIRT
[08/07/2026] - First vendor response, asking for vulnerability details
[09/07/2026] - Vulnerability details safely provided to the vendor
[20/07/2026] - Vendor was contacted again, asking for an update
[21/07/2026] - Vendor replied a security patch will be released by the end
of July
[21/07/2026] - CVE identifier requested
[21/07/2026] - CVE identifier assigned
[27/07/2026] - Reached 60-day disclosure deadline, still no official
solution
[03/08/2026] - Public disclosure


[-] CVE Reference:

CVE-2026-64829 has been assigned to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

https://karmainsecurity.com/KIS-2026-16
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/