CVE-2026-101145 in Call Recording Software
Summary
by MITRE • 09/29/2026
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The Eleveo Call Recording Software version 9.7.0 contains a critical security flaw within its User Management component, specifically located in the code handling user creation requests processed by the file /callrec/userAddAction.do. This vulnerability manifests as an LDAP injection weakness resulting from insufficient validation and sanitization of input data provided through the Username argument. When a remote attacker submits specially crafted input for this field, they can inject arbitrary LDAP commands into backend queries executed by the application server. Because the software fails to properly escape or filter special characters commonly used in LDAP syntax such as parentheses asterisks and ampersands, the injected payload is interpreted as part of the query structure rather than literal data. This fundamental failure allows an unauthenticated attacker to manipulate directory service operations remotely without requiring prior authentication credentials.
The operational impact of this vulnerability is severe given that Eleveo systems typically manage sensitive telephony records and user access controls within enterprise environments. Successful exploitation enables attackers to bypass intended authorization checks potentially allowing them to retrieve unauthorized information from the LDAP directory such as usernames passwords or other personally identifiable information associated with existing users. Furthermore depending on the specific configuration of the underlying Active Directory or OpenLDAP server an attacker might escalate privileges by creating new administrative accounts modifying group memberships or even deleting critical user objects. The availability of public exploits significantly lowers the barrier to entry for malicious actors increasing the likelihood of automated attacks targeting vulnerable instances across the internet. Organizations relying on this software face substantial risks including data breaches regulatory non-compliance and potential disruption of communication services if attacker actions lead to account lockouts or service degradation through resource exhaustion via crafted queries.
From a classification perspective this vulnerability aligns with CWE-90 which describes Improper Neutralization of Special Elements used in an LDAP Query commonly known as LDAP Injection. It also relates closely to CWE-20 where improper input validation allows malicious data to alter the intended logic of a command or query. In terms of offensive security frameworks such as MITRE ATT&CK this activity falls under techniques associated with Discovery and Credential Access particularly those involving directory service enumeration and manipulation. The lack of response from the vendor regarding early disclosure attempts leaves current deployments exposed without official patches or guidance for remediation forcing administrators to rely on workarounds until a fix is released by Eleveo.
Mitigation strategies must focus on immediate defensive measures since no patch exists at this time. Administrators should implement strict input validation rules that reject any special characters in the Username field except those explicitly required for standard alphanumeric usernames such as hyphens or underscores if permitted by policy. Web Application Firewalls can be configured with specific rule sets to detect and block LDAP injection patterns including common metacharacters and logical operators within POST requests targeting the userAddAction endpoint. Network segmentation should isolate call recording servers from direct internet exposure restricting access to trusted internal subnets only where possible. Additionally enabling detailed logging on both the application server and the underlying directory service allows for monitoring of anomalous query patterns that may indicate exploitation attempts. Organizations are strongly advised to review their LDAP configuration to ensure least privilege principles apply limiting what attributes can be read or modified by application-bound service accounts used during user creation processes until a vendor-supplied patch becomes available.