Introduction
A command injection flaw in MegaSys Telenium Online Web Application lets remote attackers execute code without authentication on critical network management infrastructure. Telecommunications, energy, and government organizations that run Telenium face an immediate risk of compromise until they address it.
About MegaSys and Telenium: MegaSys Computer Technologies is a Canadian vendor with more than 35 years in network management. It serves more than 100 energy providers, telecom networks, and government agencies. Its Telenium platform is a network management suite that supports hundreds of device types, and General Electric rebrands it as Advanced NMS. Telenium is widely deployed in critical infrastructure environments.
Technical information
CVE-2025-10659 is a critical vulnerability in the Telenium Online Web Application, classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The flaw is in a PHP endpoint that unauthenticated network users can reach. The endpoint tries to validate user input with a regular expression, but the check is insecurely terminated, so attackers can supply input that bypasses it.
When the endpoint receives a crafted HTTP request, it puts user-supplied input into an OS command without proper sanitization. Attackers can inject shell metacharacters or command separators (such as ;, &, or |) to execute arbitrary commands on the server. Those commands run with the privileges of the web application's service account, which may have significant access depending on how the deployment is configured.
No public code snippets or proof-of-concept details are available. The vulnerability requires no authentication, so exploitation is possible from any network location that can reach the web interface.
Affected systems and versions
- Product: MegaSys Telenium Online Web Application
- Affected: All versions with the vulnerable PHP endpoint accessible to unauthenticated users
- Public advisories list no specific version numbers or ranges as of the date of this post
- The vulnerability is present when the web interface is exposed to untrusted networks
Vendor security history
MegaSys has addressed similar vulnerabilities in Telenium before, including CVE-2025-8769 (improper input validation in a Perl script). The company typically issues advisories and patches in coordination with CISA. The repeated input validation flaws, though, point to ongoing problems in its secure development and testing practices. MegaSys offers customers a dedicated support portal and 24/7 technical support.
