TrueConf Server CVE-2025-66823

Exploitation requires an account with conference creation or editing privileges on the targeted TrueConf Server 5.5.2.10813 instance (CVSS PR:L confirms authentication is mandatory). The attacker must insert the malicious payload into the conference description field via the Create or Edit conference interface. Victim interaction is required: the payload only executes when a target user navigates to the specific conference's Info page at [conference_url]/info, so the attacker must direct or socially engineer the victim to visit that URL. Exploitation is constrained to TrueConf Server 5.5.2.10813 on Windows; no other platforms or versions are confirmed vulnerable. Limiting factors include: the requirement for a valid authenticated account (eliminating unauthenticated attackers), the necessity of victim-initiated navigation to the info URL, and the Windows-only platform scope per CPE data.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yields a medium score of 5.4, accurately capturing the key constraints: an authenticated low-privilege account is required (PR:L), and a victim must open the Conference Info page (UI:R). The Scope Change (S:C) elevates real-world impact by allowing the attacker to operate in the victim's browser context, enabling session token theft or content manipulation beyond what C:L/I:L alone suggest. EPSS at 0.17% (7th percentile) signals low automated or mass exploitation activity, consistent with the authentication prerequisite limiting opportunistic scanning. The public PoC lowers technical barriers for targeted abuse. No KEV listing means active exploitation is not confirmed by CISA. Overall, this is a genuine but constrained risk: prioritize remediation for internet-facing TrueConf deployments or environments where conference creation is open to untrusted authenticated users; internal deployments with tightly controlled conference creation permissions face lower realistic risk.

An attacker holding any low-privilege TrueConf account with conference creation rights crafts a conference whose description contains a malicious HTML payload - for example, a script tag that exfiltrates document.cookie to an attacker-controlled endpoint. The attacker then shares or promotes the conference URL, causing an administrator or participant to open the /info page, at which point the stored payload fires silently in the victim's browser. With a public PoC available, this attack requires no specialized skill beyond a valid TrueConf account.