Description
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
Published: 2026-08-03
Score: 8.6 High
EPSS: 1.5% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is in action_audio.php for Telenia Software TVox versions 26.5.3 and earlier, and 24.9.21 and earlier 24.x. An unsanitized pid request parameter is passed directly to exec() when the action parameter is set to checkProcess. An authenticated attacker can inject arbitrary OS commands through that pid value, allowing execution with the privileges of the apache user. This provides remote command execution, enabling the attacker to potentially take full control of the host system.

Affected Systems

Telenia Software TVox 26.5.3 and all earlier 26.x releases, as well as 24.9.21 and all earlier 24.x releases.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. EPSS is 2%, indicating a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attack requires authenticated web-application access, and the attacker can execute arbitrary OS commands with apache privileges once the checkProcess endpoint is invoked with a crafted pid parameter.

Generated by OpenCVE AI on August 4, 2026 at 21:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a TVox release that removes the exec() call in action_audio.php.
  • Restrict the action=checkProcess endpoint so only authorized administrators can invoke it.
  • Validate or sanitize the pid parameter to accept only numeric values, preventing command injection.

Generated by OpenCVE AI on August 4, 2026 at 21:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Teleniasoftware
Teleniasoftware tvox
Vendors & Products Teleniasoftware
Teleniasoftware tvox

Mon, 03 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Description Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
Title Telenia TVox 26.5.3 OS Command Injection via action_audio.php
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Teleniasoftware Tvox
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-03T16:31:34.083Z

Reserved: 2026-07-29T21:07:39.202Z

Link: CVE-2026-67608

cve-icon Vulnrichment

Updated: 2026-08-03T14:41:22.389Z

cve-icon NVD

Status : Received

Published: 2026-08-03T14:16:27.793

Modified: 2026-08-03T16:16:30.910

Link: CVE-2026-67608

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T21:15:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')