CVE-2026-15470

Executive Summary

CVE-2026-15470 is an improper authorization vulnerability (CWE-862) in Eleveo Call Recording Software version 9.7.0, specifically affecting the /callrec/group.jsp endpoint. An unauthenticated remote attacker can query this endpoint to enumerate or access group-level data without any credentials, violating access-control expectations. The vulnerability has a CVSS base score of 5.3 (Medium) due to low confidentiality impact, network attack vector, and no required privileges or user interaction. The vendor was notified early in the disclosure process but has not responded, and no patch is currently available; a public exploit has been disclosed, increasing immediate risk for exposed deployments.

Technical Analysis

The vulnerable component is a JSP servlet, group.jsp, located under the /callrec/ application context — the administrative/management interface of the Eleveo call recording platform. JSP (Jakarta Server Pages) files in this context are typically accessed by authenticated supervisory or administrator users to manage recording groups, which map extension ranges, agents, and retention policies.

The flaw is an improper authorization condition: the servlet does not perform an adequate session/role validation before servicing the request. The NVD description confirms that "some unknown functionality" of this file is affected, meaning the exact parameter or method (GET/POST) is not publicly documented. However, based on the vulnerability class (CWE-862) and the file name, group.jsp likely exposes group-management actions (e.g., list, create, delete, modify group members).

Mechanism: When a client sends an HTTP request to /callrec/group.jsp (e.g., GET /callrec/group.jsp?action=list or GET /callrec/group.jsp?id=1), the server processes the request without first verifying the existence of a valid session token (JSESSIONID) or the user's role (e.g., ADMIN vs. SUPERVISOR). The servlet's code path for authorization is either missing entirely or incorrectly implemented (e.g., checking a parameter instead of a server-side session attribute).

Attack surface:

• Network vector: The application is reachable over HTTP/HTTPS (default ports 80/443, or custom ports like 8080).
• Pre-auth: No privilege required (PR:N), no user interaction (UI:N).
• Complexity: Low (AC:L) — no special conditions, race conditions, or specialized payloads needed beyond constructed HTTP requests.

Data exposure: The confidentiality impact is Low (C:L) per the CVSS vector, suggesting the endpoint leaks group configuration data (names, IDs, extension lists) but not necessarily call recordings or full credentials. Integrity and availability are unaffected.

Weakness chain: The issue maps to CWE-862 (Missing Authorization). The application fails to enforce a mandatory access control check on the servlet's doGet/doPost method, allowing direct invocation.

Exploitation Scenarios

The exploit is publicly disclosed, but no full exploit code has been released. An attacker follows this step-by-step chain:

1. Reconnaissance / Target Identification:

   • Scan for exposed Eleveo instances using Shodan or Censys with dorks like http.title:"Eleveo" or http.html:"/callrec/".
   • Use nmap -sV -p80,443,8080 <target> to fingerprint the HTTP service and confirm the Path /callrec/.
   • Verify version 9.7.0 through the login page footer or static JavaScript/CSS file headers.

2. Trigger / Weaponization:

   • Send an unauthenticated GET request:

     GET /callrec/group.jsp?action=list HTTP/1.1
     Host: <target>
     

   • If action parameter is not the expected trigger, enumerate likely parameters: ?mode=all, ?cmd=view, ?group_id=1, or simply GET /callrec/group.jsp without parameters (default behavior may dump the first group).
   • Because authentication is bypassed, no Cookie: JSESSIONID=... header is required. The server responds with HTTP 200 and a JSP-rendered HTML table of groups.

3. Payload / Execution:

   • No separate payload is needed — the request itself is the exploit. Attackers may script enumeration using a loop:

     for i in $(seq 1 100); do curl -s "http://<target>/callrec/group.jsp?id=$i" -o group_$i.html; done
     

   • This yields all accessible groups, including group names, associated extension ranges, and possibly agent assignments.

4. Post-Exploitation Impact:

   • The attacker maps the entire organizational telephony structure — extension blocks, agent-to-group mappings, and recording retention settings.
   • This data can be used for targeted social engineering (knowing internal extension schemes), to plan further authenticated attacks (e.g., credential stuffing against the admin portal), or to identify high-value groups (e.g., executive lines) for later interception if combined with other vulnerabilities.
   • No write access is gained; however, group data may feed phishing campaigns that are significantly more convincing because the attacker references actual internal phone numbers and department names.

Impact Assessment

• Business Impact: Confidentiality breach of organizational telephony configuration. Call recording systems are sensitive: group structures reveal which individuals or departments are being recorded, potentially exposing internal org charts and security-sensitive lines (e.g., legal, HR).
• Affected Systems: All Eleveo Call Recording Software 9.7.0 deployments where the /callrec/ web interface is reachable from an untrusted network. Internet-facing instances are fully exposed; internal-only instances are at risk from network attackers with footholds.
• Blast Radius: The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) quantifies: unauthenticated remote attack, low complexity, zero user interaction, but limited to low confidentiality impact. Attackers cannot modify group data (I:N) nor disrupt service (A:N). The blast radius is therefore informational — a foothold for further exploitation rather than a direct data breach.
• CVSS note: The confidentiality score is 3.4 (Low) — reflects leakage of non-critical metadata. However, in a telecom compliance context (e.g., under GDPR), even group metadata may carry regulatory significance.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to Eleveo /callrec/group.jsp
id: 3f8d6c2e-9b1a-4f6d-8c3a-1e2b4d5f7a90
status: experimental
description: Detects unauthenticated HTTP requests to the Eleveo group.jsp endpoint, indicating CVE-2026-15470 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15470
author: ValtersIT Threat Intel
date: 2026/02/11
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Eleveo application'
detection:
    selection:
        cs-uri-path:
            - '/callrec/group.jsp'
        cs-method:
            - 'GET'
            - 'POST'
    filter_known_good:
        cs-uri-query|contains: 'jsessionid'  # legitimate sessions carry session ID in URL (if configured)
    condition: selection and not filter_known_good
falsepositives:
    - Internal monitoring tools that crawl the app without JSESSIONID
    - Misconfigured load balancer health checks pointing to /callrec/
level: high

YARA Rule

rule Eleveo_CVE_2026_15470_GroupJSP_Access
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects HTTP request lines targeting Eleveo group.jsp without session cookie"
        cve = "CVE-2026-15470"
        date = "2026-02-11"
        severity = "medium"
    strings:
        $path = "/callrec/group.jsp"
        $get = "GET" ascii wide
        $post = "POST" ascii wide
        $no_cookie = "Host:" ascii wide  // baseline for full header scan
    condition:
        uint16(0) == 0x0a0d or uint16(0) == 0x0d0a  // HTTP header at offset 0
        and $path in (0..filesize)
        and any of ($get, $post)
        and not contains(0, "Cookie: JSESSIONID")
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Eleveo Call Recording group.jsp Unauthenticated Access (CVE-2026-15470)"; flow:established,to_server; http.uri; content:"/callrec/group.jsp"; http.method; content:"GET"; http.method; content:"POST"; http.request_cookie; content:!"JSESSIONID"; classtype:attempted-recon; sid:2026070; rev:1; metadata:created_at 2026_02_11, updated_at 2026_02_11;)

Note: This rule triggers on any request to group.jsp lacking a session cookie. Operators may need to tune for internal health-check traffic.

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [network where event.type == "start" and destination.port in (80, 443, 8080)]
  [http where
     url.path == "/callrec/group.jsp" and
     http.request.method in ("GET", "POST") and
     not wildcard(http.request.headers.cookie, "*JSESSIONID*")]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/callrec/group.jsp"
| eval has_cookie=mvfind(cookie, "JSESSIONID")
| where isnull(has_cookie)
| stats count by src_ip, uri, http_method, useragent
| sort -count

Wazuh OSSEC Rule

<group name="web, eleveo, cve-2026-15470,">
  <rule id="154701" level="10">
    <decoded_as>web</decoded_as>
    <match>/callrec/group.jsp</match>
    <regex>(\sGET\s|\sPOST\s)</regex>
    <description>Eleveo group.jsp accessed without authentication - CVE-2026-15470</description>
    <group>access_control,exploit_attempt,</group>
  </rule>
</group>

Note: The level 10 indicates high severity. Wazuh analysts can augment this by correlating with session-token absence in the full log line.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — No vendor patch exists. The vendor (Eleveo) did not respond to the initial disclosure. Do not wait for a patch; assume the vulnerability is permanent in 9.7.0.

1. Immediate Mitigations (apply now):

   • Network-level ACL: Restrict access to /callrec/ to trusted IP ranges only. Place the management interface behind a VPN or bastion host. At minimum, block internet-facing access via firewall rule: deny tcp from any to <app_server> port http,https where uri contains "/callrec/group.jsp" (if proxy/firewall supports URI filtering — otherwise block the /callrec/ path entirely).
   • Reverse proxy/WAF: If an existing reverse proxy (Nginx, Apache, F5) fronts the app, add a location block to reject requests to /callrec/group.jsp unless they contain a valid session cookie. Example Nginx:

     location = /callrec/group.jsp {
         if ($http_cookie !~* "JSESSIONID") { return 403; }
         proxy_pass http://backend;
     }
     

   • Disable the endpoint: If group management is not actively used, comment out or delete group.jsp from the webapp directory (backup first). This is the most reliable immediate fix.

2. Patch/Upgrade Steps:

   • Monitor vendor channels (Eleveo support portal, CVE contact) for a security advisory. As of this report, there is no fixed version. Subscribe to the vendor RSS/security list if available.
   • If an upgrade to a later minor/hotfix release becomes available, test and deploy it. Verify the changelog explicitly mentions CWE-862 or authorization fixes for group.jsp before assuming it is patched.

3. Long-Term Hardening:

   • Code review: Request the vendor's secure development lifecycle output; if open-source access is available, audit group.jsp for missing request.isUserInRole("admin") checks or equivalent.
   • Segregation: Move the call-recording management plane to a dedicated VLAN with strict egress/ingress policies.
   • Monitoring: Implement the detection rules above and alert on any unauthenticated request to /callrec/ — even if it appears legitimate post-mitigation, it could indicate a WAF bypass or misconfiguration.
   • Least privilege: Ensure the web server runs with minimal OS privileges so that if other endpoints are compromised, lateral movement is limited.
   • Credential hygiene: Since group data can be used for credential stuffing against the admin portal, enforce MFA on all administrative accounts for this product.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15470 — official CVE record, NVD description, CVSS metrics (5.3).
2. Vendor (unresponsive): Eleveo official site — https://www.eleveo.com/ (no advisory published; vendor contact attempted per CVE).
3. CWE-862 Reference: https://cwe.mitre.org/data/definitions/862.html — Missing Authorization weakness class.
4. Exploit Disclosure Source: VulDB entry for CVE-2026-15470 — public exploit disclosure, no code. URL (vuldb.com) — searchable by ID.
5. CISA KEV: Not listed — no known exploitation in the wild as of this report. EPSS score 0.00207 (11th percentile) supports low immediate exploit likelihood, but the public disclosure raises awareness risk.

Threat Actor Campaigns: No specific APT or cybercrime campaigns attributed to this CVE at publication time. The low EPSS percentile suggests limited mass exploitation, but targeted attacks against telecommunication infrastructure (e.g., VoIP service providers) should be anticipated given the sensitive nature of call recording metadata.