Is there a public PoC exploit available for CVE-2026-15377?

Yes, a public proof-of-concept exploit is available for CVE-2026-15377. Prioritise patching immediately. EPSS: 0.3%.

Eleveo Call Recording CVE-2026-15377

Q: What is the CVSS score of CVE-2026-15377?

CVE-2026-15377 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42945 LOW

Improper Authorization (CWE-285)

2026-07-10 VulDB

GHSA-wr4j-hg4g-74fm

Authentication Bypass Call Recording Software Eleveo

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requiring low-privilege authentication; confidentiality-only impact limited to log file exposure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 10, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Jul 10, 2026 - 17:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 10, 2026 - 17:13 vuln.today

DescriptionCVE.org

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlogfile. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 exposes the /callrec/sendlogfile endpoint to low-privileged authenticated remote attackers, enabling unauthorized access to log file functionality with confirmed confidentiality impact. The flaw (CWE-285) stems from missing or bypassable authorization checks on a sensitive operational endpoint within the call recording platform. A publicly available proof-of-concept exploit exists, and the vendor failed to respond to coordinated disclosure - no patch has been released.

Technical ContextAI

Eleveo Call Recording Software (CPE: cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*) is a telecommunications call recording and compliance platform. The vulnerable component is the /callrec/sendlogfile HTTP endpoint, which handles log file transmission functionality. The root cause is CWE-285 (Improper Authorization) - the application either omits an authorization check for this endpoint entirely or implements one that can be bypassed by an actor with only low-level authenticated access. This class of flaw commonly arises when internal administrative or diagnostic endpoints are exposed via the same interface as standard user functions without enforcing role separation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms network reachability with low attack complexity and a low privilege requirement, indicating the endpoint is accessible to any authenticated session regardless of assigned role.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. As a primary compensating control, restrict access to the /callrec/sendlogfile endpoint at the network layer by blocking or rate-limiting requests to that URI path via a web application firewall or reverse proxy rule; this removes remote reachability without affecting core recording functionality. Secondarily, enforce strict role-based access controls at the application layer if the platform supports endpoint-level ACLs, ensuring only administrative roles can invoke log-send operations. Organizations should additionally review Eleveo logs for anomalous access to the /callrec/sendlogfile path to identify potential prior exploitation. Monitor VulDB (https://vuldb.com/vuln/377444) and the Eleveo vendor channel for patch availability. The trade-off of blocking the endpoint outright is potential disruption to legitimate log shipping workflows - validate with operations before deploying.