TrueConf Server CVE-2025-66834

Exploitation requires the attacker to hold a valid, authenticated low-privileged user account on TrueConf Server 5.5.2.10813 (Windows) with permission to set or modify their Display Name. A second, mandatory prerequisite is that a user with chat log export rights - typically an administrator - must export those logs to CSV format and then open the resulting file in spreadsheet software that evaluates formula triggers (e.g., Microsoft Excel with DDE enabled, LibreOffice Calc). Exploitation is blocked when: the victim uses a formula-inert CSV viewer; the export feature is administratively disabled or restricted to specific roles; Display Name changes are constrained by server policy; or Excel DDE execution is disabled via Group Policy. The CVSS PR:L metric confirms a minimum of a low-privileged authenticated account is required - unauthenticated exploitation is not possible.

The CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) accurately reflects the principal limiting factors: a valid low-privileged account is required, and exploitation depends on UI:R - a privileged user must export and then open the chat log in spreadsheet software that evaluates formulas. These are non-automated, human-driven steps that significantly reduce the probability of opportunistic or automated exploitation at scale. The EPSS score of 0.27% (20th percentile) is consistent with this assessment and aligns with the low likelihood of near-term mass exploitation. Absence from the CISA KEV catalog corroborates that no confirmed active exploitation has been observed. The publicly available proof-of-concept does lower the technical barrier for motivated attackers and is the most significant risk-elevating signal. Real-world priority should be moderate: significant for organizations where chat log CSV exports are a routine administrative workflow, but not warranting emergency incident-level response for organizations where that export feature is unused or restricted.

An attacker with a standard TrueConf Server user account sets their Display Name to a malicious DDE formula string such as '=CMD|'/C powershell -w hidden -enc <payload>'!A1'. When a TrueConf administrator subsequently exports the chat history to CSV and opens the file in Microsoft Excel without DDE protections enforced, Excel prompts to update links and - if the user accepts - executes the attacker's payload on the administrator's workstation. A public proof-of-concept demonstrating this technique is available on GitHub, substantially lowering the required attacker skill level.