CVE-2026-67608

Telenia TVox 26.5.3 OS Command Injection via action_audio.php

Published Aug 3, 2026 CVSS 4.0 · 8.6 High EPSS 2.4% KEV · Not listed

Description

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

Analysis

Technical impact

The vulnerability is in action_audio.php for Telenia Software TVox versions 26.5.3 and earlier, and 24.9.21 and earlier 24.x. An unsanitized pid request parameter is passed directly to exec() when the action parameter is set to checkProcess. An authenticated attacker can inject arbitrary OS commands through that pid value, allowing execution with the privileges of the apache user. This provides remote command execution, enabling the attacker to potentially take full control of the host system.

Affected Systems

Telenia Software TVox 26.5.3 and all earlier 26.x releases, as well as 24.9.21 and all earlier 24.x releases.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity. EPSS is 2%, indicating a low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attack requires authenticated web-application access, and the attacker can execute arbitrary OS commands with apache privileges once the checkProcess endpoint is invoked with a crafted pid parameter.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Telenia Software

TVox

affected

Version	Status	Constraints
`26.0.0`	affected	≤ 26.5.3
`24.0.0`	affected	≤ 24.9.21

No data.

Vendor Product Versions

Teleniasoftware

Tvox

Version	Status	Scheme	Platform
`[26.0.0,26.5.3]`	affected	semver	—
`[24.0.0,24.9.21]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to a TVox release that removes the exec() call in action_audio.php.
Restrict the action=checkProcess endpoint so only authorized administrators can invoke it.
Validate or sanitize the pid parameter to accept only numeric values, preventing command injection.

Generated by OpenCVE AI on August 4, 2026 at 21:03 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.4% (2.428% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://karmainsecurity.com/KIS-2026-15
https://www.teleniasoftware.com/
https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php

History

Aug 3, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 3, 2026 2:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Teleniasoftware Teleniasoftware tvox
Vendors & Products		Teleniasoftware Teleniasoftware tvox

Aug 3, 2026 1:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
Title		Telenia TVox 26.5.3 OS Command Injection via action_audio.php
Weaknesses		CWE-78
References		https://karmainsecurity.com/KIS-2026-15 https://www.teleniasoftware.com/ https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`