CVE-2026-3502

HIGHCISA KEV

7.8

Descripcion

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

Detalles CVE

Puntuacion CVSS v3.17.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Vector de ataqueADJACENT_NETWORK

ComplejidadLOW

Privilegios requeridosHIGH

Interaccion usuarioREQUIRED

Publicado3/30/2026

Ultima modificacion4/3/2026

Fuentenvd

Avistamientos honeypot0

CISA KEV

VendedorTrueConf

ProductoClient

Nombre vulnerabilidadTrueConf Client Download of Code Without Integrity Check Vulnerability

Fecha inclusion KEV2026-04-02

Fecha limite remediacion2026-04-16

Uso en ransomwareUnknown

Productos afectados

trueconf:trueconf

Debilidades (CWE)

CWE-494

Referencias

https://trueconf.com/blog/update/trueconf-8-5(cve@checkpoint.com)

https://research.checkpoint.com/2026/operation-truechaos-0-day-exploitation-against-southeast-asian-government-targets/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3502(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.