Eleveo Call Recording EUVD-2026-88480

Requires an authenticated low-privilege account (PR:L) on the Eleveo Call Recording Software 9.7.0 web console and network access to reach the User Management endpoint /callrec/userAddAction.do; the application must be backed by an LDAP directory for the injected Username to reach a directory query. No user interaction is needed (UI:N). Exploitation is LIMITED by the authentication requirement and by the deployment using LDAP-backed user management; impact is confined to low confidentiality (directory information disclosure) with no integrity or availability effect per the vendor vector.

This is a high-CVSS-appearance-but-modest-real-risk issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a network-reachable but authenticated (PR:L) LDAP injection with only low confidentiality impact and no integrity or availability impact - the 5.3 score is bounded by the requirement for valid low-privilege credentials and the limited technical impact. The E:P in the vendor vector and the 'POC/Exploit: Publicly available' signal align: publicly available exploit code exists (a Google Drive link via VulDB #410997), but there is NO EPSS score, NO CISA KEV listing, and NO evidence of active exploitation. POC availability must not be conflated with exploitation in the wild. Weighing the signals together: authentication requirement + niche product + low impact + POC-only status = low operational priority despite remote reachability. All intelligence originates from a single source (VulDB); there is no independent vendor confirmation because the vendor did not respond to disclosure, so affected-version and fix data are unverified.

A low-privileged authenticated user of the Eleveo call-recording web console submits a crafted Username value to /callrec/userAddAction.do containing LDAP filter metacharacters, injecting into the directory query performed by the User Management component. This lets the attacker manipulate the LDAP filter to enumerate or extract directory information beyond their intended scope. Publicly available exploit code (referenced via VulDB) lowers the practical barrier, though valid credentials are still required.