CVE-2026-67608
Received Received - Intake

OS Command Injection in Telenia Software TVox

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-67608
EUVD
EUVD-2026-52293

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
telenia_software tvox to 26.6.0 (exc)
telenia_software tvox to 25.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Telenia Software TVox versions 26.5.3 and prior (26.x) and 24.9.21 and prior (24.x) have an OS command injection flaw in action_audio.php. Authenticated attackers can exploit this by setting the action parameter to checkProcess and injecting malicious commands via the pid parameter. The unsanitized input is passed to an exec() call, allowing arbitrary OS command execution with apache user privileges.

Detection Guidance

Check if TVox versions 26.5.3 or prior 26.x, or 24.9.21 or prior 24.x are installed. Inspect network traffic for requests to action_audio.php with action=checkProcess and a pid parameter containing shell metacharacters or commands.

Impact Analysis

An attacker could gain control over the server hosting TVox, steal sensitive data, install malware, or disrupt services. Since commands run as the apache user, they may access or modify application data, escalate privileges, or pivot to other systems in the network if additional vulnerabilities exist.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized data access or processing, and HIPAA if protected health information is exposed. It undermines security controls required by these regulations, potentially leading to fines, legal action, and reputational damage for affected organizations.

Mitigation Strategies

Upgrade TVox to a patched version beyond 26.5.3 or 24.9.21. If immediate upgrade is not possible, restrict access to action_audio.php via firewall rules and ensure the apache user has minimal privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart