CVE-2025-10659
CRITICAL EPSS 63.2%
Published Sep 30, 20259mo ago · Modified Jun 17, 20262w ago
9.3 CVSS 4.0
Published Sep 30, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago
Description
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a crafted HTTP request, leading to remote code execution on the server in the context of the web application service account.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
63.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-78 OS Command Injection Injection
References 2
- support.portal.megasys.com https://support.portal.megasys.com/
- cisa.gov https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.