CVE-2025-10659 MegaSys Enterprises Telenium Online Web Application OS Command Injection
Unauthenticated attackers can inject arbitrary OS commands via a crafted HTTP request to achieve remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10659?
CVE-2025-10659 is a critical command injection vulnerability in MegaSys Telenium Online Web Application:, published on 30 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a crafted HTTP request, leading to remote code execution on the server in the context of the web application service account.
Weakness: CWE-78
Which versions are affected by CVE-2025-10659?
How do I fix CVE-2025-10659?
No fix has been published for CVE-2025-10659 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-10659 being exploited?
There is no known exploitation of CVE-2025-10659 in the wild and no public exploit code.
Sources
Also known as GHSA-37px-qm7m-8c7q.