Loading story…
A critical security vulnerability has been identified in the MegaSys Enterprises Telenium Online Web Application, allowing unauthenticated attackers to execute arbitrary operating system commands on affected servers. The flaw, tracked as CVE-2025-10659, arises from improper input handling in a PHP endpoint that is accessible over the network without authentication. Specifically, the vulnerability is due to insecure termination of a regular expression check, which fails to adequately validate or sanitize user-supplied input. As a result, attackers can craft malicious HTTP requests that inject OS commands, leading to remote code execution within the security context of the web application service account. The vulnerability affects Telenium Online Web Application versions 8.4.21 and prior, as confirmed by both CVE and CISA advisories. The issue is classified as an OS command injection (CWE-78), a category of vulnerabilities known for their high impact and ease of exploitation. The CVSS v3.1 base score for this vulnerability is 9.8, indicating a critical risk, while a CVSS v4 score of 9.3 further underscores its severity. The vulnerability is remotely exploitable and requires no user interaction or authentication, making it particularly dangerous for internet-exposed systems. Successful exploitation could allow attackers to gain control over the affected server, potentially leading to data theft, service disruption, or lateral movement within the network. The vulnerability was disclosed by ics-cert@hq.dhs.gov and has been publicly documented in both CVE and CISA ICS advisories. Organizations using the Telenium Online Web Application are strongly advised to review their deployments and apply any available patches or mitigations. The advisories do not specify the exact versions affected beyond 8.4.21 and prior, so all users of the product should consider themselves at risk until further information is available. No reports of exploitation in the wild have been confirmed at the time of the advisories' publication, but the low attack complexity and high impact make rapid remediation essential. The vulnerability highlights the ongoing risks associated with improper input validation in web applications, especially those used in industrial control system environments. Security teams should prioritize network segmentation and monitoring for unusual HTTP request patterns targeting the vulnerable endpoint. The incident serves as a reminder of the importance of secure coding practices and regular security assessments for critical infrastructure software.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CISA published ICS Advisory ICSA-25-273-01 warning of CVE-2025-10659, a critical unauthenticated OS command injection vulnerability in MegaSys Enterprises Telenium Online Web Application. CISA said the issue had no known public exploitation at the time of publication.
MegaSys Enterprises provided a fix for an OS command injection vulnerability in the Telenium Online Web Application and directed customers to its support resources for remediation. The flaw affects version 8.4.21 and earlier and can allow remote code execution via a crafted HTTP request.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026
Ivanti has disclosed a critical vulnerability (CVE-2025-10573) in its Endpoint Manager (EPM) software, which allows unauthenticated remote attackers to execute arbitrary JavaScript code via a stored cross-site scripting (XSS) attack. The flaw enables attackers to register fake managed endpoints to the EPM server, thereby injecting malicious JavaScript into the administrator web dashboard. When an administrator interacts with the compromised dashboard, the attacker can hijack the session and potentially gain full control over the EPM environment. Ivanti has released a patch (EPM 2024 SU4 SR1) to address this issue and strongly urges customers to update, especially since hundreds of EPM instances are exposed to the internet, increasing the risk of exploitation. The vulnerability, assigned a CVSS score of 9.6, affects EPM versions 2024 SU4 and below. Security researchers at Rapid7, who discovered and reported the flaw, emphasize the urgency of patching due to the unauthenticated nature of the attack vector. Ivanti EPM is widely used for endpoint management, remote administration, and compliance, making it a high-value target for attackers. In addition to CVE-2025-10573, Ivanti has also released fixes for three other high-severity vulnerabilities in the same update cycle. Security teams are advised to apply the latest patches immediately and review the exposure of EPM instances to the internet to mitigate the risk of compromise.
Jun 29, 2026
A set of critical vulnerabilities has been identified in the METZ CONNECT EWIO2 series, including models EWIO2-M, EWIO2-M-BM, and EWIO2-BM running firmware versions below 2.2.0. The most severe issue is an authentication bypass (CVE-2025-41733/41734) that allows unauthenticated attackers with network access to gain administrative control over the device. Exploitation enables attackers to change configurations, manipulate data, disrupt services, and potentially render the device inoperable. Additional vulnerabilities include improper control of filename for include/require statements, unrestricted upload of dangerous file types, path traversal, and improper access control, collectively enabling remote code execution and full device compromise. CISA has issued an ICS advisory (ICSA-25-322-05) highlighting the remote exploitability and low attack complexity of these flaws, assigning a CVSS v4 base score of 9.3. The vulnerabilities stem from the commissioning wizard failing to validate device initialization, allowing attackers to set root credentials via crafted POST requests. Organizations using affected METZ CONNECT EWIO2 devices are urged to review technical details and apply mitigations to prevent unauthorized access and maintain device integrity and availability.
Jun 29, 2026