CVE-2026-67608
Telenia TVox 26.5.3 OS Command Injection via action_audio.php
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
| CWE | CWE-78 |
| Vendor | telenia software |
| Product | tvox |
| Published | Aug 3, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for telenia software tvox
Be the first to know when new high vulnerabilities affecting telenia software tvox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Telenia Software / TVox
26.0.0 ≤ 26.5.3 24.0.0 ≤ 24.9.21
References
Credits
Egidio Romano