CVE-2026-67608: Telenia TVox 26.5.3 OS Command Injection via action_audio.php
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in actionaudio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Telenia Software TVoxto a version that resolves this vulnerability.Fixed in 26.5.3 - Upgrade
Upgrade
Telenia TVoxto a version that resolves this vulnerability.Fixed in 24.9.21 - Configuration
Prevent action_audio.php from executing OS commands via exec() by refusing/handling action=checkProcess requests that include the pid parameter in the exec() path.
Telenia TVox action_audio.php action parameter / checkProcess handling = disable or refuse action=checkProcess requests that use the pid parameter
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67608?
CVE-2026-67608 has a severity rating of 7.2, which is classified as high.
How do I fix CVE-2026-67608?
To mitigate CVE-2026-67608, update Telenia TVox to a version later than 26.5.3 or 24.9.21.
What type of vulnerability is CVE-2026-67608?
CVE-2026-67608 is categorized as an OS command injection vulnerability.
Who is affected by CVE-2026-67608?
CVE-2026-67608 affects Telenia TVox versions 26.5.3 and prior as well as 24.9.21 and prior.
Can CVE-2026-67608 be exploited remotely?
Yes, CVE-2026-67608 can be exploited by authenticated attackers who can remotely inject commands.