PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-8769 MegaSys Computer Technologies CVE debrief

CVE-2025-8769 is a critical remote code execution vulnerability in the Telenium Online Web Application by MegaSys Computer Technologies. The vulnerability stems from improper input validation in a Perl script responsible for loading the login page, allowing attackers to inject arbitrary Perl code via crafted HTTP requests. This vulnerability was initially published on September 19, 2024, as ICSA-24-263-04 with CVE-2024-6404, then updated on August 12, 2025, to assign CVE-2025-8769. Affected versions include Telenium Online Web Application 8.3 and earlier. The CVSS 3.1 score of 9.8 reflects network attack vector, low attack complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. MegaSys has released patched versions 7.4.72 and 8.3.36 to address this vulnerability. Organizations unable to immediately patch should consider disabling the web/browser-based interface as a temporary mitigation measure.

Vendor
MegaSys Computer Technologies
Product
Telenium Online Web Application
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-19
Original CVE updated
2025-08-12
Advisory published
2024-09-19
Advisory updated
2025-08-12

Who should care

Organizations operating MegaSys Telenium Online Web Application for industrial control system management, particularly in critical infrastructure sectors. Security teams responsible for OT/ICS environments, web application security, and Perl-based application deployments should prioritize patching.

Technical summary

The Telenium Online Web Application contains a Perl script used to load the login page that fails to properly validate user-supplied input. An unauthenticated remote attacker can exploit this weakness by sending a crafted HTTP request containing malicious Perl code, which the server executes, resulting in full remote code execution. The vulnerability affects all versions up to and including 8.3. The attack requires no authentication, no user interaction, and can be executed over the network with low complexity.

Defensive priority

critical

Recommended defensive actions

  • Apply vendor patches: upgrade to Telenium Online Web Application v7.4.72 or v8.3.36 as appropriate for your deployment.
  • If immediate patching is not feasible, disable the web/browser-based interface to mitigate exposure.
  • Restrict network access to the Telenium Online Web Application to authorized administrative hosts only.
  • Monitor web application logs for anomalous HTTP requests targeting the login page or Perl script endpoints.
  • Contact MegaSys Computer Technologies support for additional assistance with remediation.

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-24-263-04. The advisory was initially published September 19, 2024, and updated August 12, 2025, to replace CVE-2024-6404 with CVE-2025-8769. Affected product confirmed as Telenium Online Web Application versions 8.3 and earlier. Vendor fixes confirmed as versions 7.4.72 and 8.3.36.

Official resources

2024-09-19