# The Video Conferencing Platform You Forgot to Patch Is Under Active Attack
Federal cybersecurity officials don't add vulnerabilities to their exploited list as a theoretical exercise. When CISA updates the Known Exploited Vulnerabilities catalog, it means attackers are already inside somewhere. This week's additions — a cluster of critical flaws in TrueConf Server, a video conferencing platform with deep roots in government and enterprise networks — deserve more attention than they're getting.
## TrueConf: The Conferencing Vendor Most Security Teams Can't Name
TrueConf is a Moscow-founded video conferencing company with a substantial installed base across government agencies, healthcare networks, and enterprise clients — particularly in Europe, the Middle East, and former Soviet states, but with deployments scattered across U.S. infrastructure as well. If you're in security, you may never have heard of it. That's part of the problem.
When organizations went remote in 2020, many IT teams bolted on whatever worked. TrueConf offered on-premises deployment — an appealing alternative for organizations that didn't trust their data to Zoom's or Teams' cloud. Those same on-premises deployments are now the attack surface.
The vulnerabilities CISA flagged include SQL injection flaws and path traversal issues that can be chained to achieve unauthenticated remote code execution. The SQL injection bugs require no credentials to trigger. An attacker who can reach the TrueConf web interface — and in many deployments, that interface is exposed directly to the internet — can interact with the backend database, extract credentials, and pivot into the wider network. Path traversal compounds the problem by allowing file reads outside intended directories, potentially exposing configuration files and stored authentication material.
## What "Exploited in the Wild" Actually Means
CISA's KEV catalog is not a prediction engine. Entries require evidence of active exploitation, not just published proof-of-concept code. The agency doesn't always disclose who was compromised or how it knows, but the bar is real.
What we know: someone is using these bugs right now, against live targets. The specific CVEs — including CVE-2024-43375 and related identifiers — were publicly disclosed in late 2024. The gap between disclosure and KEV listing tells a familiar story: a vendor patches, organizations delay, and threat actors move faster than IT teams.
For federal civilian agencies, CISA's directive is mandatory. They have three weeks to patch or implement compensating controls. But the more consequential audience is the broader enterprise world — healthcare networks, defense contractors, municipal governments — that runs TrueConf on-premises and isn't subject to binding operational directives.
## The Conference Room as Attack Vector
Video conferencing infrastructure has become a persistent soft underbelly in enterprise security. The pattern is consistent enough to be embarrassing at this point.
Cisco Webex had severe vulnerabilities in its server components in 2023 that allowed unauthenticated attackers to join meetings and execute code. Zoom's client and server bugs generated a steady stream of patches through 2020 and 2021, several involving memory corruption in video parsing. Poly and Yealink conferencing hardware have appeared in multiple national security advisories. And now TrueConf joins the list.
The through-line isn't any particular technology — it's organizational behavior. Video conferencing platforms get deployed rapidly, often by teams under pressure, and then they sit. The web management interfaces get forgotten. The update cadence that applies to endpoint protection and firewalls rarely applies to the conference room appliance or the on-premises video server. Security teams tend to discover these systems during an incident, not before one.
TrueConf's on-premises model makes this worse. Cloud-hosted services at least get vendor-pushed updates. Self-hosted TrueConf Server installations require an administrator who knows the system exists, knows updates are available, and chooses to apply them. In organizations that deployed TrueConf four years ago and since moved to Teams as their primary platform, that administrator may not exist anymore.
## The Geopolitical Layer
It would be reductive to treat every vulnerability in software with Russian origins as a geopolitical story — bugs are bugs, and SQL injection doesn't care about politics. But context matters for defenders doing risk triage.
TrueConf's Moscow roots mean that any sensitive discussions conducted over it — internal security meetings, executive conversations, government proceedings — deserve a second look at what data might have been accessible if these servers were compromised. Video conferencing platforms don't just route calls. They store meeting recordings, chat logs, contact directories, and often integrate with directory services like Active Directory or LDAP. A compromised TrueConf server can be a window into the entire organizational identity infrastructure.
Organizations with elevated threat profiles — defense contractors, critical infrastructure operators, healthcare networks with government contracts — should treat TrueConf exposure as a higher-priority issue than the average enterprise.
## What Defenders Should Do Right Now
The remediation path is straightforward, which is almost never the hard part:
---
## HackWire Analysis
The TrueConf situation is a case study in how the enterprise attack surface quietly expands without anyone deciding to expand it.
In 2020, video conferencing went from a nice-to-have to existential infrastructure in a matter of weeks. Security teams were focused on securing home endpoints and VPN capacity. The conference room got wired up on an emergency basis, the on-premises server got spun up to avoid the cloud, and then the pandemic response consumed every security engineer's attention for two years. By the time the dust settled, TrueConf Server was running in the corner of the data center, patched to whatever version IT installed in the rush, and nobody's primary concern anymore.
This is the tail-risk of emergency deployments. They harden eventually, or they don't. The ones that don't become exactly what CISA is describing this week.
What bothers me about how this is being covered is the focus on "patching" as the story. The real story is the inventory problem. Most organizations genuinely don't know what's running on their internal networks at the version level. They patch what they can see; they don't see TrueConf Server because it was installed by a team that no longer exists, under a project that's been closed for three years. Active exploitation of forgotten infrastructure is not a new threat category — it's the most reliable way attackers get in.
CISA's KEV catalog is an increasingly powerful forcing function for federal agencies. The private sector doesn't have the same external pressure. Until organizations treat their own video infrastructure with the same patch discipline they apply to Windows and Active Directory, we'll keep writing versions of this story.
— HackWire Editorial
---
## Related Coverage