OS Command Injection in Telenia Software TVox

Telenia Software TVox versions 26.5.3 and prior, as well as 24.9.21 and prior, contain a critical OS command injection vulnerability. The flaw exists in the 'action_audio.php' script, which improperly sanitizes user-supplied input. An authenticated attacker can exploit this by sending a crafted HTTP request where the 'action' parameter is set to 'checkProcess' and the 'pid' parameter contains malicious shell metacharacters. The underlying application uses the 'pid' input directly within an exec() system call. Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the web server (apache) user. This vulnerability impacts the core functionality of the TVox platform and poses a significant risk for lateral movement and system compromise.

Impact

Successful exploitation allows unprivileged authenticated attackers to escalate their control to arbitrary code execution at the web server level. This provides a foothold for further malicious activity, such as data exfiltration, internal network reconnaissance, or the deployment of additional payloads within the TVox environment.

Recommendation

• Update Telenia Software TVox to version 26.5.4 or 24.9.22 immediately to patch CVE-2026-67608.
• Review web server access logs for anomalous POST or GET requests to 'action_audio.php' containing shell metacharacters such as semicolon, pipe, or backticks in the 'pid' parameter.
• Implement request validation at the Web Application Firewall (WAF) layer to block common command injection strings targeting the 'pid' parameter in the identified file.