CISA orders US agencies to patch two exploited TrueConf server flaws by September 10

CISA’s directive to patch two TrueConf Server vulnerabilities by September 10 signals that these flaws are being actively exploited, though the agency does not specify the full scope of targets. The only publicly documented attacks come from Kaspersky, which attributed them to Head Mare, a pro-Ukrainian hacktivist group targeting Russian organizations. However, TrueConf’s global user base, including government and infrastructure entities, means the impact could extend beyond Russia. The lack of clarity on whether US organizations are affected leaves open the possibility of broader exploitation.

The vulnerabilities allow unauthenticated attackers with network access to TCP port 4307 to execute arbitrary code on the underlying server. TrueConf’s documentation indicates this port is open by default, increasing the attack surface for organizations that have not hardened their deployments. The flaws affect versions dating back to 2022, and while patches were released in June, the risk persists for unupdated servers. Exploitation is not automatic; it requires direct network access, meaning servers on isolated internal networks are less exposed unless an attacker has already breached the perimeter.

The attack chain described by Kaspersky demonstrates a supply-chain risk beyond the immediate targets. Hackers used their access to replace legitimate TrueConf client installers with trojanized versions carrying the PhantomCore backdoor. This means employees joining conferences hosted by compromised third parties, such as suppliers or partners, could unknowingly download malware. The risk is compounded by TrueConf’s on-premises model, which shifts responsibility for security updates to the customer, unlike cloud-based alternatives where patches are applied centrally.

For engineers, the immediate action is to verify whether TrueConf Server is deployed in their environment and apply the patches if so. The vulnerabilities underscore the importance of disabling unnecessary default services and restricting network access to critical ports. Organizations using TrueConf should also consider whether their deployment model, on-premises versus cloud, aligns with their security posture, particularly if they lack the resources to monitor and patch systems promptly. The incident serves as a reminder that conferencing software, often overlooked in security assessments, can become a high-value target for attackers.