{"id":"CVE-2026-72529","kind":"vulnerability","aliases":["CVE-2026-72529"],"related":[],"title":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9,…","description":"TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"TrueConf Server has a missing authentication check on a critical function, reachable over the network on TCP port 4307. A remote unauthenticated attacker can run an arbitrary script on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-08-20T00:00:00+00:00","products":[{"name":"trueconf server","fixed":["5.3.9.10013"],"affected":"< 5.3.9.10013","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.3.9.10015"],"affected":"< 5.3.9.10015","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.4.9.10072"],"affected":">= 5.4.0.12689, < 5.4.9.10072","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.4.9.10019"],"affected":">= 5.4.0.12700, < 5.4.9.10019","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.5.5.10010"],"affected":">= 5.5.0.13826, < 5.5.5.10010","ecosystem":"vendor"},{"name":"trueconf server","fixed":["5.5.5.10009"],"affected":">= 5.5.0.13828, < 5.5.5.10009","ecosystem":"vendor"},{"name":"TrueConf Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","on-prem-video","self-hosted","trueconf","vendor","windows"],"not_affected_if":["managed-hosting","port-4307-not-exposed"],"how_to_check":"Check whether TrueConf Server is listening on TCP port 4307 and reachable from untrusted networks (unknown exact command from sources).\nReview the server's network exposure and firewall rules for port 4307.\nReview logs for unexpected script execution or connections to port 4307 (unknown specific indicators from sources).","fix":"Apply the mitigations and vendor update per CISA guidance; the specific fixed version is unknown from sources.\nIf no mitigation is available, restrict or disconnect the product per BOD 26-04 guidance.","status":"open","published_at":"2026-08-19T17:21:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:53+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:31:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and vendor update per CISA guidance; the specific fixed version is unknown from sources.\nIf no mitigation is available, restrict or disconnect the product per BOD 26-04 guidance.","summary":"TrueConf Server has a missing authentication check on a critical function, reachable over the network on TCP port 4307. A remote unauthenticated attacker can run an arbitrary script on the server.","category":"vendor","who_cares":["trueconf","self-hosted","windows","on-prem-video"],"confidence":0.7,"analyst_note":"Find the vendor advisory and the fixed version for TrueConf Server, and confirm the affected version range and default configuration of port 4307 (see CISA KEV entry for CVE-2026-72529).","how_to_check":"Check whether TrueConf Server is listening on TCP port 4307 and reachable from untrusted networks (unknown exact command from sources).\nReview the server's network exposure and firewall rules for port 4307.\nReview logs for unexpected script execution or connections to port 4307 (unknown specific indicators from sources).","needs_analyst":true,"not_affected_if":["port-4307-not-exposed","managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000434,"input_tokens":2203,"output_tokens":428,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':127C,153C,184C '-2026':21A,24A '-72529':22A,25A '26':126C,152C,183C '4307':69B '4307/tcp':10A,104C '5.3':16A '5.3.9':19A 'access':7A,101C 'accord':116C 'action':112C 'adher':180C 'allow':94C 'appli':113C 'applic':150C 'arbitrari':77B,108C 'asset':174C 'attack':4A,73B,98C 'authent':56B,87C 'base':131C 'bod':125C,151C,182C 'check':57B 'cisa':110C,123C,140C 'cloud':156C 'complianc':121C 'contain':84C 'could':93C 'critic':60B,89C 'cve':20A,23A 'discontinu':159C 'ensur':120C,179C 'evalu':172C 'execut':106C 'exploit':40B 'exposur':177C 'follow':149C 'forens':142C 'function':61B,90C 'guidanc':138C,154C 'guidelin':186C 'host':47B 'instruct':119C 'internet':176C 'miss':55B,86C 'mitig':114C,165C 'network':6A,65B,100C 'note':137C,148C 'on-prem-video':41B 'patch':185C 'port':9A,68B,103C 'prem':43B 'priorit':128C 'product':163C 'reachabl':62B 'remot':2A,71B,96C 'requir':111C,144C 'respons':170C 'risk':133C 'run':75B 'script':78B,109C 'secur':129C 'see':134C,145C 'self':46B 'self-host':45B 'server':14A,27A,29A,31A,33A,35A,37A,39A,52B,81B,83C 'servic':157C 'stakehold':168C 'tcp':67B 'triag':143C 'trueconf':13A,26A,28A,30A,32A,34A,36A,38A,48B,51B,82C 'unauthent':72B 'unauthor':3A,97C 'unavail':167C 'updat':130C 'url':135C,146C 'use':160C 'vendor':49B,118C 'version':15A 'via':8A,102C 'video':44B 'vulner':91C 'window':50B 'x':17A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-19T17:21:00+00:00","kev":{"dateAdded":"2026-08-20","dueDate":"2026-08-23","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@kaspersky.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-72529","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-72529","severity":null,"published_at":"2026-08-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-72529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72529","severity":null,"published_at":"2026-08-19T17:21:00+00:00","modified_at":"2026-08-21T04:18:15+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}