CVE-2025-29902 is a critical remote code execution (RCE) vulnerability affecting the Telex Remote Dispatch Console Server version 1.0.0. The underlying issue is classified as CWE-94, which pertains to improper control over the generation of code, commonly known as code injection. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the server hosting the affected product without requiring any user interaction. The vulnerability is exploitable remotely over the network (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The scope of the vulnerability is complete (S:C), meaning that exploitation can affect resources beyond the initially vulnerable component. The impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), indicating that an attacker can fully compromise the server, potentially gaining control over sensitive data, modifying or deleting information, and disrupting service availability. The Telex Remote Dispatch Console Server is typically used in critical communication environments, such as emergency dispatch centers, where reliability and security are paramount. The lack of available patches at the time of publication increases the urgency for organizations to implement alternative mitigations. Although no known exploits are currently reported in the wild, the critical severity and ease of exploitation make this vulnerability a significant threat that could be rapidly weaponized by attackers once exploit code becomes available.

For European organizations, especially those involved in emergency services, public safety, and critical infrastructure, this vulnerability poses a severe risk. Successful exploitation could lead to full system compromise, allowing attackers to disrupt dispatch operations, manipulate communication data, or cause denial of service. This could have cascading effects on public safety and emergency response effectiveness. Additionally, organizations handling sensitive personal data or operational information could suffer data breaches, regulatory penalties under GDPR, and reputational damage. The critical nature of the vulnerability combined with the strategic importance of dispatch systems in Europe elevates the potential impact to a national security concern in some cases. The disruption of emergency communication services could also have direct consequences on citizen safety and trust in public institutions.

Given the absence of an official patch, European organizations should immediately implement network-level mitigations such as isolating the Telex Remote Dispatch Console Server from untrusted networks and restricting access via firewalls to only trusted IP addresses. Employing network intrusion detection and prevention systems (IDS/IPS) with signatures or heuristics targeting code injection attempts can help detect exploitation attempts. Organizations should conduct thorough audits of server configurations to disable any unnecessary services or interfaces that could be leveraged by attackers. Implementing strict input validation and application-layer firewalls, if possible, can reduce attack surface. Regularly monitoring logs for unusual activity and establishing incident response plans tailored to this vulnerability are critical. Organizations should also engage with Telex and relevant vendors to obtain patches or updates as soon as they become available and prioritize timely deployment. Finally, considering compensating controls such as deploying endpoint detection and response (EDR) solutions on the server host can help detect and mitigate post-exploitation activities.