CVE-2026-85405 in Call Recording Software
Summary
by MITRE • 09/04/2026
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Eleveo Call Recording Software version 9.7.0 contains a critical security vulnerability within its web application interface, specifically affecting the endpoint /callrec/roleAddAction.do. This component is responsible for handling role creation or modification requests and processes user-supplied input through an argument labeled as name or username. The flaw represents a classic instance of Cross-Site Scripting, commonly referred to by industry standards such as CWE-79 (Improper Neutralization of Input During Web Page Generation). In this specific context, the application fails to adequately sanitize or encode special characters within the provided input fields before rendering them in subsequent HTTP responses. This lack of proper validation allows an attacker to inject malicious client-side scripts into web pages viewed by other users.
The operational impact of this vulnerability is significant due to its remote exploitability and the nature of Cross-Site Scripting attacks. An adversary can craft a specially formatted URL or form submission that includes JavaScript code within the username parameter. When an administrator or authorized user accesses the affected page, their browser executes the injected script in the context of the application's domain. This enables session hijacking, where attackers steal authentication cookies and tokens to impersonate legitimate users. It also facilitates credential theft through phishing techniques embedded within the malicious scripts, as well as defacement of the web interface or redirection of victims to external malicious sites. Since the exploit has already been published in public repositories, automated scanning tools and opportunistic attackers are likely actively targeting instances of this software version that remain unpatched on accessible networks.
From a threat intelligence perspective aligned with MITRE ATT&CK frameworks, this vulnerability maps directly to techniques involving web application attacks. Specifically it aligns with T1059 (Command and Scripting Interpreter) when the script performs actions like keylogging or data exfiltration, and more broadly under T1189 (Drive-by Client Compromise) if the payload leads to further malware downloads via browser exploits triggered by the XSS vector. The persistence of this flaw is exacerbated by the vendor's lack of response to disclosure attempts, leaving organizations with no official patch timeline. This silence forces system administrators to rely on workarounds rather than definitive fixes.
Mitigation strategies must focus on immediate containment and input validation since a software update is not currently available from Eleveo. Administrators should implement strict input filtering at the web server or application firewall level to block requests containing script tags, event handlers, or encoded JavaScript payloads targeting the /callrec/roleAddAction.do endpoint. Additionally enabling Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute. If possible isolating the call recording system behind a reverse proxy with WAF capabilities provides an effective layer of defense against remote exploitation attempts until the vendor releases a corrected version or alternative security controls are deployed within the application code itself.