This vulnerability, identified as CWE-306 (Missing Authentication for Critical Function), affects TrueConf Server versions <5.3, >=5.3 <5.3.9, >=5.4 <5.4.9, and >=5.5 <5.5.5. An unauthenticated remote attacker with network access to TCP port 4307 can invoke an undocumented function to execute arbitrary scripts on the server. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary scripts on the TrueConf Server, potentially leading to full compromise of the server's confidentiality, integrity, and availability. This could enable unauthorized control or disruption of the affected system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to port 4307/TCP to trusted sources only and monitor for unusual activity related to this port.