Telenia TVox <= 26.5.3 Local Privilege Escalation via Unsafe Sudoers Configuration (CVE-2026-64829)

Vulnerability Overview Local Privilege Escalation vulnerability in Telenia Software TVox <= 26.5.3 (nice). This vulnerability is caused by an insecure configuration in the file. The user is permitted to execute the command with privileges without a password. Since can be abused to invoke arbitrary commands, this configuration error allows attackers to execute arbitrary commands as the user using the account, thereby achieving local privilege escalation. Affected Versions Affected Versions: - Version 26.5.3 and earlier 26.x versions. - Version 24.9.21 and earlier 24.x versions. - Older versions may also be affected. Remediation No official solution is currently available. Disclosure Timeline [22/05/2026] - Contacted vendor, no response [27/05/2026] - Notified vendor of the vulnerability, no response [27/05/2026] - Informed vendor of the 60-day disclosure deadline policy, no response [26/06/2026] - Contacted vendor again and reached out to CSIRT Italy; CSIRT did not respond [08/07/2026] - Vendor responded for the first time, requesting vulnerability details [09/07/2026] - Securely provided vulnerability details to the vendor [20/07/2026] - Contacted vendor again to request an update [21/07/2026] - Vendor replied that a security patch will be released by the end of July [21/07/2026] - Requested a CVE identifier [21/07/2026] - CVE identifier assigned [27/07/2026] - Reached the 60-day disclosure deadline; still no official solution [03/08/2026] - Public disclosure CVE Reference CVE-2026-64829 has been assigned to this vulnerability. Proof of Concept Proof of Concept Credits Vulnerability discovered by Egidio Romano. Code Block

Goal Reached Thanks to every supporter — we hit 100%!

Telenia TVox <= 26.5.3 Local Privilege Escalation via Unsafe Sudoers Configuration (CVE-2026-64829)