This vulnerability in Eleveo Call Recording Software 9.7.0 affects the Call Recording Handler component, where improper authorization occurs due to manipulation of the callId parameter in /callrec/audio.jsp. The weakness allows an attacker with low privileges to remotely access functionality or data they should not be authorized to access. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official remediation or patch has been disclosed by the vendor despite early notification. Public exploit code has been released, increasing the risk of exploitation.

An attacker can remotely exploit this vulnerability by manipulating the callId argument to bypass authorization controls in the call recording handler. This could lead to unauthorized access to call recordings or related functionality. The impact is limited by the requirement of low privileges but does not require user interaction. The availability of public exploit code increases the likelihood of exploitation. No further impact details are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, organizations should consider restricting access to the affected component (/callrec/audio.jsp) and monitor for suspicious activity related to callId parameter manipulation. Implementing network-level controls to limit access to the call recording software may reduce exposure until an official fix is available.