This vulnerability in Eleveo Call Recording Software 9.7.0 affects an unspecified part of the /callrec/pci_dss_status.jsp file, leading to improper authorization. Remote attackers can exploit this flaw without user interaction or elevated privileges. The CVSS 4.0 base score is 5.3, indicating a medium severity level. The vendor was notified but has not provided any response or fix. No patch or official remediation guidance is currently available, and the software is not a cloud service, so remediation depends on vendor action.

Improper authorization can allow remote attackers to access or manipulate functionality or data that should be restricted, potentially compromising confidentiality or integrity of call recording data or related system components. The medium CVSS score reflects limited impact due to low complexity and no required privileges but also no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting access to the affected endpoint (/callrec/pci_dss_status.jsp) through network controls or application-layer protections until a fix is released.