When investigating novel 0-days leads to the discovery of novel 0-days

Telenia TVox is susceptible to Unauthenticated OS Command Injection in the /reportExporter/Export endpoint. In this blog post, we discuss how, while investigating previously disclosed TVox vulnerabilities with Claude Code, the AI autonomously discovered a novel unauthenticated RCE, and how we manually validated it on TVox 24 and 26.

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town