Description
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: LDAP Injection allowing unauthorized data access
Action: Patch
AI Analysis

Impact

The vulnerability in Eleveo Call Recording Software 9.7.0 occurs in the userAddAction.do component and allows an attacker to inject arbitrary LDAP queries through the Username argument. This injection can modify or read LDAP directory information, potentially exposing sensitive user data or enabling privilege escalation based on LDAP credentials. The flaw is reported as a remote exploitation vector with publicly available exploitation code.

Affected Systems

Eleveo Call Recording Software version 9.7.0 is affected. The issue resides in the User Management module and specifically targets the user addition functionality exposed via /callrec/userAddAction.do.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is considered moderate. EPSS is not available, and the issue is not listed in CISA KEV, indicating there are no known widespread exploit campaigns yet. The remote nature of the attack and lack of authentication requirements make it potentially reachable from the network, but the practical impact depends on the LDAP schema and permissions in place.

Generated by OpenCVE AI on September 28, 2026 at 21:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade Eleveo Call Recording Software to a release that fixes the LDAP injection flaw.
  • If a patch is unavailable, enforce strict input validation for the Username field in /callrec/userAddAction.do, escaping or rejecting LDAP special characters to prevent injection.
  • Disable or restrict the userAddAction.do endpoint if it is not required, and monitor LDAP logs for anomalous query patterns that could indicate exploitation attempts.

Generated by OpenCVE AI on September 28, 2026 at 21:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Eleveo Call Recording Software User Management userAddAction.do ldap injection
First Time appeared Eleveo
Eleveo call Recording Software
Weaknesses CWE-74
CWE-90
CPEs cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*
Vendors & Products Eleveo
Eleveo call Recording Software
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Eleveo Call Recording Software
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T22:44:19.391Z

Reserved: 2026-09-28T08:11:31.271Z

Link: CVE-2026-101145

cve-icon Vulnrichment

Updated: 2026-10-01T14:55:30.796Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T21:17:12.370

Modified: 2026-10-20T23:16:53.720

Link: CVE-2026-101145

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T21:45:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-90

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')