CVE-2026-15377
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/sendlogfile. An unknown functionality causes improper authorization, allowing remote attacks. The exploit has been publicly disclosed and may be used.
Risk Assessment
The organization is at risk of remote unauthorized operations on the call recording system, potentially leading to sensitive data leakage or service disruption.
Recommendation
Immediately restrict access to the /callrec/sendlogfile file, implement additional authorization mechanisms, and monitor logs for exploitation attempts.
Other vulnerabilities in Eleveo Call Recording Software
See all- CVE-2026-15474Medium
An improper authorization vulnerability has been discovered in Eleveo Call Recording Software 9.7.0. The unknown function in the /callrec/audio.jsp file fails to properly validate permissions for the callId parameter, allowing unauthorized access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-15472Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/composeEmailAction.do. Unknown code allows remote manipulation leading to improper authorization. The exploit has been publicly disclosed and may be used.
- CVE-2026-15471Medium
A vulnerability in Eleveo Call Recording Software 9.7.0 was found in the /callrec/pci_dss_status.jsp file, allowing unauthorized access. The attack can be performed remotely and the exploit has been made public. The vendor did not respond to the disclosure.
- CVE-2026-15470Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/group.jsp. An unknown functionality leads to improper authorization, which can be exploited remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-15376Medium
A vulnerability in Eleveo Call Recording Software 9.7.0 affects the file /callrec/statisticReportAction.do. An unknown function leads to improper authorization, allowing remote exploitation. The exploit is public, and the vendor did not respond.
- CVE-2026-15375Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/users_ldap.jsp of the LDAP User Interface component. An unknown function leads to improper authorization, exploitable remotely. The exploit has been publicly disclosed.
- CVE-2026-15374Medium
A flaw in Eleveo Call Recording Software 9.7.0 affects the file /callrec/roleAddAction.do in the Group Interface component. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.
- CVE-2026-15373Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/userAddAction.do. An unknown function improperly authorizes the role argument, allowing unauthorized actions. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlogfile. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.