CISA orders feds to patch actively exploited TrueConf Server flaws
-
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited flaws in the TrueConf Server self-hosted communications platform to its Known Exploited Vulnerabilities catalog, mandating that federal agencies patch the issues by a strict deadline. The directive applies to CVE-2025-31162 and CVE-2025-31163, both of which have been confirmed as targets of ongoing attacks in the wild.
TrueConf Server is widely used by organizations for video conferencing and collaboration, often deployed on-premises for security-conscious environments. The first vulnerability, an improper access control issue, allows an unauthenticated attacker to gain unauthorized access to system resources. The second is a command injection flaw that could permit remote code execution with elevated privileges. Combined, these weaknesses could let a threat actor completely compromise a vulnerable server, pivot to internal networks, and deploy persistent backdoors.
CISA’s binding operational directive gives federal civilian agencies until late April to remediate the flaws, though all organizations running affected versions are strongly urged to act immediately. The agency also notes that these bugs are likely being used by state-sponsored actors, as is often the case when CISA moves to the emergency-patch stage.
System administrators should take the following steps:
- Update TrueConf Server to the latest patched release available from the vendor.
- Review access logs for signs of unusual or unauthorized activity, especially around exposed management interfaces.
- Restrict network access to TrueConf Server endpoints, ensuring they are not reachable from the public internet.
- If compromise is suspected, rotate credentials, audit user accounts, and consider a full reinstall of the affected system.
Patches are available directly from TrueConf, and the vendor has published advisories detailing the fixes. Given the active exploitation and the high severity of these vulnerabilities, delaying remediation is not a realistic option for any organization relying on this platform.
Source: BleepingComputer
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login