CVE-2026-67609: Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Telenia Software TVoxto a version that resolves this vulnerability.Fixed in 26.5.3 - Upgrade
Upgrade
Telenia Software TVoxto a version that resolves this vulnerability.Fixed in 24.9.21 - Configuration
Edit /etc/sudoers.d/telenia to eliminate the insecure sudoers rule that grants the apache user NOPASSWD execution of /bin/nice, which is leveraged to execute arbitrary commands as root.
Telenia TVox (sudo configuration) /etc/sudoers.d/telenia rule for apache NOPASSWD /bin/nice = Remove NOPASSWD authorization for /bin/nice for user apache (or otherwise ensure apache cannot execute /bin/nice via sudo without password)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67609?
The severity of CVE-2026-67609 is high with a CVSS score of 7.8.
How do I fix CVE-2026-67609?
To fix CVE-2026-67609, review and update the sudoers configuration to restrict permissions for the apache account.
What systems are affected by CVE-2026-67609?
CVE-2026-67609 affects Telenia Software TVox versions 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions.
What type of vulnerability is CVE-2026-67609?
CVE-2026-67609 is a privilege escalation vulnerability that allows attackers to execute commands as root.
What access do attackers need to exploit CVE-2026-67609?
Attackers need access to the apache account to exploit CVE-2026-67609.