Analysis Summary
# Vulnerability: TrueConf Server Missing Authentication for Critical Function
## CVE Details
- CVE ID: CVE-2026-72529
- CVSS Score: 9.8 (Critical) *(Note: Advisory text lists 0.0 but the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H calculates to 9.8)*
- CWE: CWE-306: Missing Authentication for Critical Function
## Affected Systems
- Products: TrueConf Server (Windows and Linux)
- Versions:
- All versions prior to 5.3
- 5.3.X prior to 5.3.9
- 5.4.X prior to 5.4.9
- 5.5.X prior to 5.5.5
- Configurations: Systems with port 4307/TCP exposed to the network.
## Vulnerability Description
The vulnerability stems from a lack of authentication on an undocumented function within the TrueConf Server. An unauthorized remote attacker can interact with this function via port 4307/TCP. By calling this specific function, the attacker can achieve Remote Code Execution (RCE) by running arbitrary scripts on the server.
## Exploitation
- Status: Exploited in the wild (Linked to "Head Mare" APT group activities).
- Complexity: Low
- Attack Vector: Network
## Impact
- Confidentiality: High
- Integrity: High
- Availability: High
## Remediation
### Patches
Update TrueConf Server to one of the following patched versions:
- 5.3.9
- 5.4.9
- 5.5.5
### Workarounds
- Restrict network access to port 4307/TCP to trusted IP addresses only.
- Implement robust network segmentation to isolate the video conferencing server from critical internal assets.
## Detection
- **Indicators of Compromise:** Scan for indicators associated with the "Head Mare" APT group and the "PhantomCore" malware.
- **System Auditing:** Perform a full system scan using up-to-date antivirus/EDR solutions.
- **Incident Response:** If compromise is suspected, reset all account passwords and perform a forensic analysis of the server.
## References
- Kaspersky ICS CERT Advisory: hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/
- NVD CVE Entry: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-72529
- CWE-306 Definition: hxxps[://]cwe[.]mitre[.]org/data/definitions/306[.]html