CVE-2026-15471
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in Eleveo Call Recording Software 9.7.0 was found in the /callrec/pci_dss_status.jsp file, allowing unauthorized access. The attack can be performed remotely and the exploit has been made public. The vendor did not respond to the disclosure.
Risk Assessment
The organization is at risk of unauthorized access to sensitive PCI DSS-related data, potentially leading to compliance violations and data leakage.
Recommendation
Immediately restrict access to the /callrec/pci_dss_status.jsp file and deploy temporary WAF rules to block the known exploit. Consider updating the software once a patch is released.
Other vulnerabilities in Eleveo Call Recording Software
See all- CVE-2026-15474Medium
An improper authorization vulnerability has been discovered in Eleveo Call Recording Software 9.7.0. The unknown function in the /callrec/audio.jsp file fails to properly validate permissions for the callId parameter, allowing unauthorized access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-15472Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/composeEmailAction.do. Unknown code allows remote manipulation leading to improper authorization. The exploit has been publicly disclosed and may be used.
- CVE-2026-15470Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/group.jsp. An unknown functionality leads to improper authorization, which can be exploited remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-15377Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/sendlogfile. An unknown functionality causes improper authorization, allowing remote attacks. The exploit has been publicly disclosed and may be used.
- CVE-2026-15376Medium
A vulnerability in Eleveo Call Recording Software 9.7.0 affects the file /callrec/statisticReportAction.do. An unknown function leads to improper authorization, allowing remote exploitation. The exploit is public, and the vendor did not respond.
- CVE-2026-15375Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/users_ldap.jsp of the LDAP User Interface component. An unknown function leads to improper authorization, exploitable remotely. The exploit has been publicly disclosed.
- CVE-2026-15374Medium
A flaw in Eleveo Call Recording Software 9.7.0 affects the file /callrec/roleAddAction.do in the Group Interface component. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.
- CVE-2026-15373Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/userAddAction.do. An unknown function improperly authorizes the role argument, allowing unauthorized actions. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.