Eleveo Call Recording CVE-2026-15377

Exploitation requires a valid authenticated session with low-privilege credentials on the Eleveo Call Recording Software 9.7.0 instance - the CVSS 4.0 PR:L metric confirms some level of authentication is necessary. The vulnerable endpoint /callrec/sendlogfile must be network-reachable from the attacker's position (AV:N). No special platform configuration, non-default feature toggle, or elevated role is needed beyond baseline authenticated access. What limits exploitation: unauthenticated remote attackers cannot directly exploit this flaw; an attacker must first obtain valid credentials for the Eleveo platform, whether through phishing, credential reuse, or insider access. No user interaction is required once credentials are obtained. The attack is constrained to confidentiality impact only - no integrity or availability degradation is achievable via this vector per available data.

The CVSS 4.0 score of 5.3 (Medium) with VC:L/VI:N/VA:N reflects a limited but real confidentiality exposure - log files from call recording infrastructure may contain call metadata, user identifiers, session tokens, or operational intelligence useful for lateral movement. The E:P supplemental metric confirms a proof-of-concept is available, elevating practical exploitability above the base score alone. There is no CISA KEV listing, so active exploitation in the wild is not confirmed. The EPSS score is not provided in the source data, limiting probabilistic exploitation forecasting. The PR:L requirement means exploitation is bounded to authenticated users - unauthenticated remote exploitation is not supported by available data. The vendor's non-response to disclosure is a significant risk signal: no patch is available, no vendor advisory exists, and the timeline for remediation is unknown. Real-world risk is moderate for organizations running Eleveo 9.7.0, particularly in regulated environments where call recording logs contain sensitive compliance data.

An authenticated low-privileged user - such as a call center agent or supervisor with a standard Eleveo account - sends a crafted HTTP request to the /callrec/sendlogfile endpoint, bypassing the intended authorization boundary. Because the endpoint lacks proper role enforcement, the attacker gains access to log file content or triggers log transmission to an attacker-controlled destination, exposing call metadata, session details, or operational data. A publicly available proof-of-concept (hosted on Google Drive per disclosure references) reduces the skill threshold required for this attack.