Backdoor in Call Monitoring, Surveillance Gear
Summary: SEC Consult found an undocumented backdoor account giving administrator-level access to NICE Systems' Recording eXpress, a call recording suite for small and medium-sized public safety organizations, allowing attackers to reach system and database level and listen to recorded calls without authentication. SEC Consult said NICE fixed the backdoor and a few other issues in a recent update but that other serious flaws remain, including multiple unauthenticated SQL injection issues, and NICE said it had resolved almost all of them and did not believe any customers were impacted.
Bottom line: The product is built for first responders and police to record and intercept calls, and researcher Nicholas Weaver's point is the stake: if an attacker takes control, the monitoring software can easily be turned against the installer.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026