# MegaSys Telenium RCE via Perl code injection

Published: 2025-08-12 · Severity: routine · Sectors: infrastructure, energy, government-national, telecommunications
Canonical: https://vorant.io/reports/adba2acb-890e-5bc2-a3d0-2d85babac5b5/megasys-telenium-rce-via-perl-code-injection

> MegaSys Telenium Online Web Application versions 8.3 and prior allow unauthenticated remote code execution through Perl injection.

MegaSys Computer Technologies' Telenium Online Web Application contains an improper input validation flaw (CWE-20) in a Perl script called during login page loading. An attacker can inject arbitrary Perl code via a crafted HTTP request, leading to unauthenticated remote code execution on the server with full system impact. The vulnerability affects versions 8.3 and prior and is exploitable remotely with low attack complexity and no user interaction required.

MegaSys has released patches addressing the flaw: version 7.4.72 and version 8.3.36. CISA reports no known public exploitation of this vulnerability at the time of advisory publication. Organizations unable to patch immediately should disable the web-based interface. Standard ICS hardening measures apply: minimize internet exposure, isolate systems behind firewalls, and use VPN for required remote access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-8769

## Detection guidance (public sample)

### Perl Injection Patterns in Web Request Query String

ATT&CK: T1190

Detects web requests whose query string carries Perl code-execution constructs (system/exec/qx/backticks), consistent with Perl code injection against a login CGI such as the Telenium flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Perl Injection Patterns in Web Request Query String
description: Detects HTTP requests whose query string contains Perl command-execution
  constructs (system, exec, qx, backticks, pipe open), consistent with Perl code injection
  into a CGI script such as the Telenium login page flaw. Matches generic injection
  syntax, not a specific path or parameter.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - system(
    - system%28
    - exec(
    - exec%28
    - qx(
    - qx%28
    - qx{
    - qx%7B
    - '%60'
    - open(STDOUT
    - open%28STDOUT
    - '|perl'
    - ;system
    - popen(
  condition: selection
falsepositives:
- Vulnerability scanners or penetration tests run against the web interface
- Applications that legitimately pass code snippets in query parameters, such as developer
  documentation portals
level: medium
id: 7a9e43fb-cda8-5cc4-b09d-9c71ce1027af
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
```

### Linux Web Server or Perl Process Spawning Shell With Download or Reverse Shell Syntax

ATT&CK: T1190

Detects a web server or Perl interpreter spawning a shell with download or reverse-shell command lines, the expected post-exploitation result of Perl code injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux Web Server or Perl Process Spawning Shell With Download or Reverse Shell
  Syntax
description: Detects perl or web server processes spawning a shell whose command line
  contains download-and-execute or reverse-shell syntax. This is the typical outcome
  of unauthenticated Perl code injection in a web-facing CGI script.
tags:
- attack.execution
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /perl
    - /httpd
    - /apache2
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - 'wget '
    - 'curl '
    - /dev/tcp/
    - bash -i
    - mkfifo
    - nc -e
    - python -c
    - perl -e
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- CGI-based administration scripts that fetch content with curl or wget
- Monitoring or health-check scripts launched by Perl that call curl
level: high
id: 55549bce-9017-511a-9fe1-608b6130fdd7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
```

### Windows Perl or Web Server Process Spawning Command Interpreter With Suspicious Arguments

ATT&CK: T1190

Detects perl.exe or web server worker processes spawning cmd or PowerShell with download-cradle or recon arguments, indicating exploitation of a web-facing Perl application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Perl or Web Server Process Spawning Command Interpreter With Suspicious
  Arguments
description: Detects perl.exe or common web server processes spawning cmd.exe or PowerShell
  with download, encoded-command or reconnaissance arguments, indicating code execution
  via a vulnerable web-facing Perl application.
tags:
- attack.execution
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \perl.exe
    - \httpd.exe
    - \apache.exe
    - \w3wp.exe
    - \tomcat9.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - certutil
    - bitsadmin
    - DownloadString
    - DownloadFile
    - Invoke-WebRequest
    - net user
    - ' -enc'
    - IEX
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web-based administration tools that shell out to run diagnostics
- Legitimate Perl deployment or maintenance scripts using PowerShell downloads
level: high
id: 98c0b69b-1a40-5d6b-a01c-45c1239da815
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/adba2acb-890e-5bc2-a3d0-2d85babac5b5/megasys-telenium-rce-via-perl-code-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup