CISA Warns of Critical RCE Flaw (CVE-2025-10659, CVSS 9.8) in Megasys Telenium Online Web Application

According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, a security advisory warns of a critical remote code execution vulnerability in the Megasys Telenium Online Web Application, tracked as CVE-2025-10659 with a CVSS v3.1 base score of 9.8. The flaw affects Megasys Telenium Online Web Application versions 8.4.21 and prior, and arises from a PHP endpoint that unauthenticated network users can access, which mishandles user-supplied input and terminates a regular expression check insecurely.

Because the input is not properly sanitised, an unauthenticated attacker could inject arbitrary operating system commands via a crafted HTTP request, potentially leading to remote code execution on the server within the web application service account. Megasys Enterprises has already supplied a patch, and customers are urged to apply it immediately by accessing the Megasys support page for installation instructions.

CISA also recommends defence-in-depth measures, including minimising network exposure for control system devices, locating such networks behind firewalls, and using VPNs for remote access, while noting VPNs themselves may have vulnerabilities and should be updated.