Telenia Software TVox <= 26.5.3 (nice) Local Privilege Escalation Vulnerability
• Software Link:
https://www.teleniasoftware.com
• Affected Versions:
Version 26.5.3 and prior 26.x versions.
Version 24.9.21 and prior 24.x versions.
Older versions may be affected as well.
• Vulnerability Description:
The vulnerability is caused by an insecure sudoers configuration in the /etc/sudoers.d/telenia file:
apache ALL=NOPASSWD: /opt/telenia/cloud/bin/check-instance-id
apache ALL=NOPASSWD: /usr/sbin/postsuper
apache ALL=NOPASSWD: /bin/nice
apache ALL=NOPASSWD: /usr/bin/hostnamectl
apache ALL=NOPASSWD: /sbin/halt
apache ALL=NOPASSWD: /sbin/rebootThe apache user is allowed to execute the nice command with root privileges without requiring a password. Since nice can be abused to invoke arbitrary commands, this misconfiguration enables an attacker with access to the apache account to execute arbitrary commands as the root user, resulting in a Local Privilege Escalation.
• Proof of Concept:
https://karmainsecurity.com/pocs/tvox_root_rce.php
• Solution:
No official solution is currently available.
• Disclosure Timeline:
[22/05/2026] – Vendor was contacted, no response
[27/05/2026] – Vendor was notified about this vulnerability, no response
[27/05/2026] – Vendor was notified about 60-day disclosure deadline policy, no response
[26/06/2026] – Vendor was contacted again along with CSIRT Italy, no response from CSIRT
[08/07/2026] – First vendor response, asking for vulnerability details
[09/07/2026] – Vulnerability details safely provided to the vendor
[20/07/2026] – Vendor was contacted again, asking for an update
[21/07/2026] – Vendor replied a security patch will be released by the end of July
[21/07/2026] – CVE identifier requested
[21/07/2026] – CVE identifier assigned
[27/07/2026] – Reached 60-day disclosure deadline, still no official solution
[03/08/2026] – Public disclosure
• CVE Reference:
CVE-2026-64829 has been assigned to this vulnerability.
• Credits:
Vulnerability discovered by Egidio Romano.