# MegaSys Telenium OS command injection vulnerability

Published: 2025-09-30 · Severity: routine · Sectors: technology, telecommunications
Canonical: https://vorant.io/reports/cc896282-d1b3-5580-8e42-c9ea57648726/megasys-telenium-os-command-injection-vulnerability

> Unauthenticated OS command injection in MegaSys Telenium Online Web Application versions 8.4.21 and prior enables remote code execution.

MegaSys Enterprises Telenium Online Web Application versions 8.4.21 and prior contain an unauthenticated OS command injection vulnerability (CVE-2025-10659) in a PHP endpoint accessible to network users. The flaw results from improper neutralization of user-supplied input due to insecure termination of a regular expression check. An attacker can craft an HTTP request to inject arbitrary operating system commands, achieving remote code execution in the context of the web application service account. No authentication is required; attack complexity is low.

The affected product is deployed worldwide in information technology and communications sectors. MegaSys has provided a fix; users should contact MegaSys support for patch instructions. CISA reports no known public exploitation of this vulnerability at the time of publication. Defenders should prioritize patching, network segmentation of ICS assets, and restricting internet exposure of the Telenium application.

## Mentioned in this report

- Vulnerabilities: CVE-2025-10659

## Detection guidance (public sample)

### Web Server or PHP Process Spawning Shell or Recon Command on Linux

ATT&CK: T1059.004

Web server or PHP interpreter spawning a shell or common post-exploitation utility, as expected after OS command injection through a PHP endpoint such as CVE-2025-10659. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Shell or Recon Command on Linux
description: Detects a web server or PHP interpreter parent spawning a shell or common
  recon/download utility. Expected pattern after unauthenticated OS command injection
  in a PHP web application (e.g. Telenium CVE-2025-10659), where commands run as the
  web service account.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /php
    - /php-cgi
    - /php-fpm
    - /apache2
    - /httpd
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /whoami
    - /id
    - /uname
    - /wget
    - /curl
    - /nc
    - /ncat
  condition: selection_parent and selection_child
falsepositives:
- PHP applications that legitimately shell out via sh -c for mail, backup or report
  generation
- Administrative web panels that invoke system utilities
level: medium
id: 086a2f45-5745-5162-b577-5b34385d3ff0
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01
```

### Web Server or PHP Process Spawning Command Interpreter on Windows

ATT&CK: T1059.003

PHP/Apache/IIS worker spawning cmd, PowerShell or recon/download tools, consistent with web-delivered OS command injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server or PHP Process Spawning Command Interpreter on Windows
description: Detects PHP, Apache or IIS worker processes spawning cmd.exe, PowerShell
  or common recon/download LOLBins. Consistent with exploitation of an OS command
  injection flaw in a PHP endpoint of a public-facing application.
tags:
- attack.execution
- attack.t1059
- attack.t1059.003
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php.exe
    - \php-cgi.exe
    - \httpd.exe
    - \w3wp.exe
    - \nginx.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \whoami.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
    - \net.exe
    - \net1.exe
  condition: selection_parent and selection_child
falsepositives:
- PHP or IIS applications that intentionally invoke cmd.exe for batch jobs
- Web-based admin tools running net or whoami for diagnostics
level: medium
id: bc37da96-cfc0-5187-bb0f-540b70e68e06
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01
```

### PHP Request with Shell Metacharacters and OS Command in Query String

ATT&CK: T1190

Web request to a .php resource where the query string combines shell metacharacters with OS commands, indicating command injection attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP Request with Shell Metacharacters and OS Command in Query String
description: Detects requests to PHP resources whose query string contains a shell
  separator (semicolon, pipe, backtick, command substitution) followed by a common
  OS command or interpreter. Indicates command injection probing or exploitation such
  as CVE-2025-10659. Requires query-string logging.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: webserver
detection:
  selection_stem:
    cs-uri-stem|endswith: .php
  selection_meta:
    cs-uri-query|contains:
    - ;
    - '%3B'
    - '|'
    - '%7C'
    - '`'
    - '%60'
    - $(
    - '%24%28'
  selection_cmd:
    cs-uri-query|contains:
    - whoami
    - /bin/sh
    - /bin/bash
    - cmd.exe
    - powershell
    - wget
    - curl
    - nc -e
    - nc%20-e
    - /etc/passwd
  condition: selection_stem and selection_meta and selection_cmd
falsepositives:
- Vulnerability scanners run by the security team
- Applications that pass legitimate text containing words like curl or powershell
  in query parameters
level: medium
id: 98628d1e-945d-580e-96b6-1b64f181b3a7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cc896282-d1b3-5580-8e42-c9ea57648726/megasys-telenium-os-command-injection-vulnerability.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup