MegaSys Telenium RCE via Perl code injection
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
MegaSys Telenium Online Web Application versions 8.3 and prior allow unauthenticated remote code execution through Perl injection.
MegaSys Computer Technologies' Telenium Online Web Application contains an improper input validation flaw (CWE-20) in a Perl script called during login page loading. An attacker can inject arbitrary Perl code via a crafted HTTP request, leading to unauthenticated remote code execution on the server with full system impact. The vulnerability affects versions 8.3 and prior and is exploitable remotely with low attack complexity and no user interaction required.
MegaSys has released patches addressing the flaw: version 7.4.72 and version 8.3.36. CISA reports no known public exploitation of this vulnerability at the time of advisory publication. Organizations unable to patch immediately should disable the web-based interface. Standard ICS hardening measures apply: minimize internet exposure, isolate systems behind firewalls, and use VPN for required remote access.
Mentioned in this report
Detection guidance
Perl Injection Patterns in Web Request Query String
Detects web requests whose query string carries Perl code-execution constructs (system/exec/qx/backticks), consistent with Perl code injection against a login CGI such as the Telenium flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Perl Injection Patterns in Web Request Query String
description: Detects HTTP requests whose query string contains Perl command-execution
constructs (system, exec, qx, backticks, pipe open), consistent with Perl code injection
into a CGI script such as the Telenium login page flaw. Matches generic injection
syntax, not a specific path or parameter.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- system(
- system%28
- exec(
- exec%28
- qx(
- qx%28
- qx{
- qx%7B
- '%60'
- open(STDOUT
- open%28STDOUT
- '|perl'
- ;system
- popen(
condition: selection
falsepositives:
- Vulnerability scanners or penetration tests run against the web interface
- Applications that legitimately pass code snippets in query parameters, such as developer
documentation portals
level: medium
id: 7a9e43fb-cda8-5cc4-b09d-9c71ce1027af
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
Linux Web Server or Perl Process Spawning Shell With Download or Reverse Shell Syntax
Detects a web server or Perl interpreter spawning a shell with download or reverse-shell command lines, the expected post-exploitation result of Perl code injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Web Server or Perl Process Spawning Shell With Download or Reverse Shell
Syntax
description: Detects perl or web server processes spawning a shell whose command line
contains download-and-execute or reverse-shell syntax. This is the typical outcome
of unauthenticated Perl code injection in a web-facing CGI script.
tags:
- attack.execution
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /perl
- /httpd
- /apache2
- /nginx
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'wget '
- 'curl '
- /dev/tcp/
- bash -i
- mkfifo
- nc -e
- python -c
- perl -e
- chmod +x
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- CGI-based administration scripts that fetch content with curl or wget
- Monitoring or health-check scripts launched by Perl that call curl
level: high
id: 55549bce-9017-511a-9fe1-608b6130fdd7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
Windows Perl or Web Server Process Spawning Command Interpreter With Suspicious Arguments
Detects perl.exe or web server worker processes spawning cmd or PowerShell with download-cradle or recon arguments, indicating exploitation of a web-facing Perl application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Perl or Web Server Process Spawning Command Interpreter With Suspicious
Arguments
description: Detects perl.exe or common web server processes spawning cmd.exe or PowerShell
with download, encoded-command or reconnaissance arguments, indicating code execution
via a vulnerable web-facing Perl application.
tags:
- attack.execution
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \perl.exe
- \httpd.exe
- \apache.exe
- \w3wp.exe
- \tomcat9.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_cmd:
CommandLine|contains:
- whoami
- certutil
- bitsadmin
- DownloadString
- DownloadFile
- Invoke-WebRequest
- net user
- ' -enc'
- IEX
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web-based administration tools that shell out to run diagnostics
- Legitimate Perl deployment or maintenance scripts using PowerShell downloads
level: high
id: 98c0b69b-1a40-5d6b-a01c-45c1239da815
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs