Eleveo Call Recording CVE-2026-85405

Exploitation requires a valid low-privilege authenticated session on the Eleveo Call Recording Software 9.7.0 instance - unauthenticated exploitation is not possible per the CVSS PR:L metric. The attacker must have access to the /callrec/roleAddAction.do endpoint, which is part of the role-management feature; if role management is restricted by access control policies to specific user roles, not all low-privilege accounts may reach it. Successful harm additionally requires that a victim user (typically an administrator) passively loads a page containing the injected payload - UI:P in CVSS 4.0. Exploitation is limited to web browser context (session hijack, DOM manipulation); it does not directly result in server-side code execution per available impact data. No special network conditions are required beyond HTTPS/HTTP access to the application.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects limited impact: PR:L confirms a low-privilege authenticated account is required, UI:P confirms passive victim interaction is needed, and VC:N/VI:L/VA:N indicates only integrity impact within the vulnerable system's browser context. EPSS data is not provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread active exploitation. However, a proof-of-concept exploit is publicly available (E:P in the CVSS 4.0 supplemental vector), which lowers the barrier for exploitation. The real-world risk is elevated by the lack of vendor response or patch - defenders cannot rely on an official fix. In practice, XSS in a role-management endpoint is a meaningful privilege escalation path: a low-privilege user could target an admin session to hijack it or perform actions on the admin's behalf. The limited deployment footprint of this niche call-recording product bounds the aggregate exposure.

An attacker with a low-privilege account on the Eleveo platform (e.g., a supervisor or agent account with access to role management) crafts a role name containing a malicious JavaScript payload and submits it via /callrec/roleAddAction.do. When an administrator subsequently navigates to the role management interface, the injected script executes in the admin's browser, potentially exfiltrating the admin's session cookie or silently performing privileged actions such as creating new admin accounts. A public proof-of-concept exploit hosted on Google Drive is available to guide this attack.