CVE-2026-67609
Received Received - Intake

Privilege Escalation in Telenia Software TVox via Insecure Sudoers Configuration

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-67609
EUVD
EUVD-2026-52324

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
telenia_software tvox to 26.6.0 (exc)
telenia_software tvox to 25.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Telenia Software TVox versions up to 26.5.3 and 24.9.21 have a privilege escalation flaw. Attackers with access to the apache account can exploit an insecure sudoers configuration to run arbitrary commands as root without a password. The configuration allows /bin/nice execution with NOPASSWD, which can be abused to gain full root access.

Detection Guidance

Check if the apache user has sudo privileges by running: sudo -l -U apache. If it shows /bin/nice with NOPASSWD, the system is vulnerable. Also verify the sudoers configuration in /etc/sudoers.d/telenia for insecure entries.

Impact Analysis

If exploited, this vulnerability allows attackers to take full control of the system, install malware, steal data, or disrupt services. It poses a high risk to confidentiality, integrity, and availability of the affected system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Remove the insecure sudoers configuration in /etc/sudoers.d/telenia. Restrict apache user privileges by editing sudoers to remove NOPASSWD for /bin/nice. Update TVox to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart