A critical authentication bypass in Telenia Software TVox allows unauthenticated attackers to gain full administrative access to restricted management scripts.

The application incorrectly validates access by checking the requested path against a hardcoded filename, which can be bypassed by appending /login_admin.php to any URI. This allows unauthenticated users to access sensitive functions within the manager HTML directory.

This flaw permits total bypass of authentication mechanisms, granting attackers unauthorized access to sensitive administrative interfaces. Given the 9.8 CVSS score, this vulnerability could result in full system takeover, data exfiltration, or complete disruption of communication services managed by TVox.

Immediate Action: Contact Telenia Software support to obtain the necessary security patches or configuration updates for the affected TVox versions.

Proactive Monitoring: Review web server access logs for any requests involving unusual URI structures or attempts to access administrative files without prior authentication headers.

Compensating Controls: Restrict access to the manager directory at the network or web server level (e.g., via IP allowlisting) until a vendor-supplied patch is applied.

Public Exploit Available: Unknown

This is a critical vulnerability that requires immediate attention due to the ease of exploitation. Organizations using Telenia Software TVox must implement strict network-level access controls immediately and coordinate with the vendor to deploy the required security updates.