PT-2025-40025 · Megasys · Megasys Telenium Online Web Application

Scott Sheach

·

Published

2025-09-30

·

Updated

2025-10-02

·

CVE-2025-10659

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions MegaSys Telenium Online Web Application (affected versions not specified)
Description The Telenium Online Web Application contains a critical command injection flaw stemming from an insecurely terminated regular expression check within a PHP endpoint. This endpoint is accessible to unauthenticated network users and improperly handles user-supplied input. An attacker can inject arbitrary operating system commands through a crafted HTTP request, resulting in remote code execution on the server in the context of the web application service account. The vulnerability allows for the execution of commands without authentication.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-10659

Affected Products

Megasys Telenium Online Web Application