CVE-2026-67608

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://karmainsecurity.com/KIS-2026-15
https://www.teleniasoftware.com/
https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Telenia Software TVox 26.5.3 y versiones 26.x anteriores, y 24.9.21 y versiones 24.x anteriores, contienen una vulnerabilidad de inyección de comandos del sistema operativo en action_audio.php que permite a atacantes autenticados ejecutar comandos arbitrarios del sistema operativo al pasar un parámetro pid no saneado a una llamada a exec() cuando el parámetro action se establece en checkProcess. Los atacantes pueden inyectar comandos maliciosos del sistema operativo a través del parámetro de solicitud pid para ejecutar comandos arbitrarios con los privilegios del usuario apache.

Information

Published : 2026-08-03 14:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-67608

Mitre link : CVE-2026-67608

CVE.ORG link : CVE-2026-67608

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-67608", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67608", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T14:41:16.763310Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Telenia Software", "product": "TVox", "versions": [{"status": "affected", "version": "26.0.0", "versionType": "semver", "lessThanOrEqual": "26.5.3"}, {"status": "affected", "version": "24.0.0", "versionType": "semver", "lessThanOrEqual": "24.9.21"}], "defaultStatus": "affected"}]}], "published": "2026-08-03T14:16:27.793", "references": [{"url": "https://karmainsecurity.com/KIS-2026-15", "source": "disclosure@vulncheck.com"}, {"url": "https://www.teleniasoftware.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user."}, {"lang": "es", "value": "Telenia Software TVox 26.5.3 y versiones 26.x anteriores, y 24.9.21 y versiones 24.x anteriores, contienen una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en action_audio.php que permite a atacantes autenticados ejecutar comandos arbitrarios del sistema operativo al pasar un par\u00e1metro pid no saneado a una llamada a exec() cuando el par\u00e1metro action se establece en checkProcess. Los atacantes pueden inyectar comandos maliciosos del sistema operativo a trav\u00e9s del par\u00e1metro de solicitud pid para ejecutar comandos arbitrarios con los privilegios del usuario apache."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}