TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)

1. Apply Official Security Patches

Immediately upgrade your TrueConf Server deployment to the latest secure version recommended by the vendor.

2. Network-Level Mitigation (Temporary Workaround)

Restrict access to TCP port 4307 at the perimeter firewall to prevent unauthorized external connections.

Linux iptables Example:

# Allow access to port 4307 only from trusted internal subnet (e.g., 192.168.1.0/24)
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 4307 -j ACCEPT
# Block all other external traffic to port 4307
sudo iptables -A INPUT -p tcp --dport 4307 -j DROP

Windows PowerShell (Windows Defender Firewall) Example:

New-NetFirewallRule -DisplayName "Block External TrueConf Port 4307" `
    -Direction Inbound `
    -LocalPort 4307 `
    -Protocol TCP `
    -Action Block

This vulnerability (CVE-2026-72529) is caused by missing authentication for a critical function (CWE-306) within TrueConf Server. An attacker with network access to TCP port 4307 can bypass authentication mechanisms and directly invoke undocumented internal functions.

By exploiting this flaw, the attacker can execute arbitrary scripts or commands under the security context of the TrueConf Server process. With a CVSS score of 9.8, this vulnerability is highly critical and has been actively exploited in the wild by threat actors (such as Head Mare) to deploy malware, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog.