CVE-2026-101141

Executive Summary

CVE-2026-101141 is a reflected cross-site scripting (XSS) vulnerability in Eleveo Call Recording Software version 9.7.0, reachable through the /callrec/audio.jsp Play Audio Page component. An authenticated, low-privileged remote attacker can inject script via the viewRoleId/cfType arguments, and successful exploitation requires user interaction (a victim visiting a crafted link). Impact is limited to integrity (C:N/I:L/A:N) per the CVSS 3.1 base score of 3.5, but the exploit has been published and the vendor is unresponsive, leaving affected deployments unpatched.

Technical Analysis

The flaw resides in the Play Audio Page component implemented in /callrec/audio.jsp. This server-side Java Server Pages (JSP) endpoint accepts request parameters, and the arguments viewRoleId and cfType are processed in a way that allows attacker-controlled input to reach the HTTP response without adequate output encoding or contextual sanitization. Because no server-side validation or escaping neutralizes HTML/JavaScript metacharacters, a crafted request results in the reflected script executing in the context of the victim's browser session.

This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable input vector is HTTP parameters to a remotely reachable JSP page. The viewRoleId parameter semantically suggests a role/identifier selection, and cfType suggests a content-format or call-flow type selector; both are user-influenced and, per the disclosure, manipulable to introduce client-side script. The specific sink (whether the value is echoed directly into HTML, embedded in a JavaScript block, or placed in an attribute) is not detailed in the available advisory, and no implementation specifics beyond the parameter names and endpoint should be assumed.

Cross-site scripting of this class typically manifests as either reflected (immediate echo of the parameter in the response) or DOM-based execution, with reflected XSS being the most common pattern for server-rendered JSP pages. Given that the attack is launched remotely and requires user interaction, the reflected model fits the CVSS profile (AV:N, PR:L, UI:R). The low-privileged attacker posture (PR:L) indicates the attacker must hold some authenticated access to reach the parameterized page or that the endpoint enforces a session context. No exploit code, Nuclei template, or public proof-of-concept artifact was recorded in the supplied intelligence, though the description states the exploit "has been published and may be used." The vulnerability is confirmed UNPATCHED, and the vendor did not respond to coordinated disclosure.

Exploitation Scenarios

No public PoC is available in the supplied dataset; the attack chain below is inferred from the vulnerability class (reflected XSS) and the specific endpoint/parameters named in the disclosure.

1. Reconnaissance / target identification. An attacker identifies an internet-exposed or internal Eleveo Call Recording 9.7.0 deployment hosting the /callrec/audio.jsp Play Audio Page. Fingerprinting relies on the presence of the Eleveo application path and the audio.jsp endpoint. The attacker must possess at least the low level of access implied by PR:L to reach the parameterized page in a valid session.

2. Triggering the flaw class. The attacker constructs a request to /callrec/audio.jsp that supplies malicious content in the viewRoleId and/or cfType argument. Because the application reflects this input into the generated HTML response without sufficient encoding, the injected markup/script becomes part of the returned page.

3. Payload / execution method (class-level). As a reflected XSS, execution occurs when the victim loads the crafted URL while holding an active session to the Eleveo application. The browser parses the reflected script in the origin of the vulnerable site. No specific script payload, DOM sink, or bypass technique is documented in the available data and none should be assumed.

4. Post-exploitation impact. Successful execution grants the attacker script execution in the victim's authenticated browser context, enabling session/token theft, action forgery on behalf of the victim, credential harvesting through injected content, and redirection or UI redressing. The CVSS modifier I:L and UI:R bound the direct impact to limited integrity effects contingent on a victim interacting with the crafted link; confidentiality and availability are rated as not impacted.

Impact Assessment

The direct technical impact is limited (CVSS 3.1 base 3.5): network attack vector, low attack complexity, low privileges required, user interaction required, scope unchanged, no confidentiality impact (C:N), low integrity impact (I:L), no availability impact (A:N). The realistic business risk concentrates on session hijacking and unauthorized actions performed in a victim's authenticated context within the Eleveo recording platform.

Blast radius considerations: Eleveo Call Recording Software handles recorded voice interactions, frequently containing sensitive customer or regulated content. Although XSS does not directly exfiltrate recordings, a script-in-the-middle session compromise can expose in-application data and facilitate lateral actions available to the victim's role. Exposure is bounded to users who possess an authenticated session and are lured into interacting with a crafted link, so the exploitation is targeted rather than worm-like. Because the exploit is public and the product is unpatched, any internet-facing deployment of version 9.7.0 should be considered at elevated risk of opportunistic attack; internal-only deployments remain exposed to phishing-style delivery.

Detection Guidance

Sigma Rule

title: Eleveo Call Recording audio.jsp XSS Parameter Tampering
id: 7e3b9a2c-1f4d-4c88-9a01-cve2026101141
status: experimental
description: Detects suspicious requests to /callrec/audio.jsp with script-like content in viewRoleId or cfType arguments
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101141
author: Threat Intelligence
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/callrec/audio.jsp'
  selection_params:
    cs-uri-query|contains:
      - 'viewRoleId='
      - 'cfType='
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '<img'
      - '%3Cimg'
      - '"><'
  condition: selection_endpoint and selection_params and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate administrative input containing encoded markup
level: medium
tags:
  - attack.t1189
  - cve.2026.101141

YARA Rule

rule CVE_2026_101141_Eleveo_AudioJsp_XSS
{
    meta:
        description = "Detects reflected XSS payloads targeting Eleveo Call Recording audio.jsp via viewRoleId/cfType"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101141"
        cve = "CVE-2026-101141"
        date = "2026-01-01"
    strings:
        $endpoint = "/callrec/audio.jsp" ascii nocase
        $p1 = "viewRoleId=" ascii nocase
        $p2 = "cfType=" ascii nocase
        $x1 = "<script" ascii nocase
        $x2 = "javascript:" ascii nocase
        $x3 = "onerror=" ascii nocase
        $x4 = "%3Cscript" ascii nocase
    condition:
        $endpoint and ($p1 or $p2) and any of ($x*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101141 Eleveo Call Recording audio.jsp Reflected XSS Attempt"; flow:to_server,established; http.uri; content:"/callrec/audio.jsp"; nocase; http.uri; content:"viewRoleId="; nocase; pcre:"/(%3C|<)script|javascript:|onerror=|onload=/i"; reference:cve,2026-101141; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101141; classtype:web-application-attack; sid:2026101141; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=30s
  [ network where url.path == "/callrec/audio.jsp" and url.query rlike "(?i)viewRoleId=.*(<script|javascript:|%3Cscript)" ]
  [ network where url.path == "/callrec/audio.jsp" and url.query rlike "(?i)cfType=.*(<script|javascript:|%3Cscript)" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/callrec/audio.jsp%")
| search uri_query="*viewRoleId=*" OR uri_query="*cfType=*"
| regex uri_query="(?i)(%3Cscript|<script|javascript:|onerror=|onload=)"
| table _time, src_ip, user, uri_path, uri_query, status
| sort - _time

Wazuh OSSEC Rule

<group name="web,eleveo,xss,">
  <rule id="2026101" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>/callrec/audio.jsp</url>
    <regex>(?i)(viewRoleId|cfType)=.*(%3Cscript|&lt;script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-101141: Possible reflected XSS attempt against Eleveo Call Recording audio.jsp</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>web_attack,cve_2026_101141,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround has been published; the vendor did not respond to coordinated disclosure.

1. Immediate mitigations. Restrict network access to /callrec/audio.jsp and the broader Eleveo web interface to trusted networks or authenticated VPN/zero-trust paths, removing internet-wide exposure. Deploy the detection rules above at the WAF, IDS, and log-pipeline layers to catch the encoded and literal script patterns in the viewRoleId/cfType arguments. Enforce strict output encoding and input validation at the reverse-proxy/WAF layer for these parameters as a compensating control. Consider shortening session lifetimes and requiring re-authentication for sensitive actions to limit the value of any hijacked session.

2. Patch/upgrade steps. No patch is available. Monitor the Eleveo vendor advisory channels and the NVD entry for CVE-2026-101141 for a fixed build. Until a vendor fix is released, treat 9.7.0 as unremediable via update and rely on compensating controls. If Eleveo publishes guidance or a patched version, validate it in a staging environment before production rollout.

3. Long-term hardening. Enforce secure development practices with context-aware output encoding for all user-influenced parameters (CWE-79 remediation). Add a strict Content-Security-Policy to the Eleveo web tier to constrain inline script execution, and deploy HttpOnly/Secure/SameSite cookie attributes to blunt session theft. Establish a vendor-risk review process given the non-responsive disclosure posture, and incorporate continuous vulnerability-scanning of the platform into the asset lifecycle.

References

• NVD — CVE-2026-101141: https://nvd.nist.gov/vuln/detail/CVE-2026-101141
• CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• Eleveo — vendor product site (advisory status: no response to disclosure): https://www.eleveo.com
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-101141 not listed as of this report.

No confirmed threat-actor campaign or verified in-the-wild exploitation telemetry is available in the supplied intelligence. The disclosure states the exploit has been published and may be used; treat this as an increased-risk indicator rather than confirmed active exploitation.