TrueConf Server CVE-2026-72529

The single hard prerequisite is network reachability to TCP port 4307 on a TrueConf Server running an affected version (5.3.X ≤ 5.3.9, 5.4.X ≤ 5.4.9, 5.5.X ≤ 5.5.5, or earlier); the attacker then calls a specific undocumented function that lacks an authentication check. No credentials, no user interaction, and no non-default configuration are required (PR:N/UI:N/AC:L), so default installations are exploitable. The only practical limiting factor is exposure of port 4307 - deployments where this management/service port is firewalled off from untrusted networks are not remotely exploitable, which is the key control defenders should verify.

All available signals point to genuine, high-priority risk rather than an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full compromise of confidentiality, integrity, and availability - the maximum realistic exposure short of a scope change. The mitigating factor is exposure surface: exploitation requires network reachability to TCP/4307, which in well-segmented deployments should not be internet-facing, so real-world blast radius depends heavily on whether this management port is exposed. No EPSS score, KEV listing, or public POC was provided, so probability-of-exploitation telemetry is missing; the absence of KEV means there is no confirmed active exploitation, and the absence of a POC means weaponization is not yet public. The signal set is internally consistent (network vector matches the port-4307 description), so no metric conflicts need flagging - the primary uncertainty is deployment exposure, not the vulnerability mechanics.

An attacker with network reachability to the TrueConf Server on TCP/4307 - for example a malicious insider on the corporate LAN or an external attacker where the port is inadvertently exposed - connects to the service and calls the undocumented function without providing credentials, causing the server to execute an attacker-supplied script. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of authentication make reliable exploitation straightforward once the protocol call is known.