Search criteria
3 vulnerabilities found for poly_studio_x50_firmware by hp
FKIE_CVE-2024-9579
Vulnerability from fkie_nvd - Published: 2024-11-05 17:15 - Updated: 2024-11-08 18:08
Severity ?
7.5 (High) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| hp | poly_tc8_firmware | * | |
| hp | poly_tc8 | - | |
| hp | poly_tc10_firmware | * | |
| hp | poly_tc10 | - | |
| hp | poly_studio_g7500_firmware | * | |
| hp | poly_studio_g7500 | - | |
| hp | poly_studio_x30_firmware | * | |
| hp | poly_studio_x30 | - | |
| hp | poly_studio_x50_firmware | * | |
| hp | poly_studio_x50 | - | |
| hp | poly_studio_x70_firmware | * | |
| hp | poly_studio_x70 | - | |
| hp | poly_studio_x52_firmware | * | |
| hp | poly_studio_x52 | - | |
| hp | poly_studio_g62_firmware | * | |
| hp | poly_studio_g62 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_tc8_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6DCF1C57-F138-4118-BAA6-7286BA78F8DC",
"versionEndExcluding": "6.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_tc8:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F053C475-D941-4D4B-B433-8D67CD9A2C71",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_tc10_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC9FC9F3-5FB5-4E3B-9AF3-72BF90FAC13F",
"versionEndExcluding": "6.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_tc10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5E9083C3-3142-494C-827C-56576ADFCA93",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_studio_g7500_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCE079BE-F301-4CB3-AEF4-7A1F8BF52F0E",
"versionEndExcluding": "4.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_studio_g7500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B27E0D-4C00-42F8-8772-1C0B1D0F64FC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_studio_x30_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "78D5810F-7044-4A7C-81E8-BF05F2163B5A",
"versionEndIncluding": "4.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_studio_x30:-:*:*:*:*:*:*:*",
"matchCriteriaId": "58648CB8-9564-4EAB-8049-65B048EF8000",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_studio_x50_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "242A2E5D-D761-458E-BA4A-53F8DFF3B0A7",
"versionEndExcluding": "4.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_studio_x50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1424706A-4E51-4513-B962-59E9ABDD71E7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_studio_x70_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "520E74F3-26F8-408C-93AD-516373EACDF1",
"versionEndExcluding": "4.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_studio_x70:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A94CC22-4C6E-4415-9AB3-E0A3EC7BD672",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_studio_x52_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "383C1531-70D5-4BB2-AB8D-49D92E661739",
"versionEndExcluding": "4.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_studio_x52:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06C69912-7DB0-4510-884B-3FFF7AC6B1FB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hp:poly_studio_g62_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5315BF05-1706-4A5B-9A9D-104AEDDC2C5C",
"versionEndExcluding": "4.3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hp:poly_studio_g62:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FF7F293C-3F38-40DB-B909-F6E0C32219E0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself."
},
{
"lang": "es",
"value": " Se descubri\u00f3 una vulnerabilidad potencial en ciertos dispositivos de videoconferencia de Poly. El fallo del firmware no desinfecta adecuadamente la entrada del usuario. La explotaci\u00f3n de esta vulnerabilidad depende de un ataque en capas y no puede explotarse por s\u00ed sola."
}
],
"id": "CVE-2024-9579",
"lastModified": "2024-11-08T18:08:02.683",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "hp-security-alert@hp.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-11-05T17:15:07.667",
"references": [
{
"source": "hp-security-alert@hp.com",
"tags": [
"Vendor Advisory"
],
"url": "https://support.hp.com/us-en/document/ish_11536495-11536533-16/hpsbpy03900"
}
],
"sourceIdentifier": "hp-security-alert@hp.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "hp-security-alert@hp.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2024-9579 (GCVE-0-2024-9579)
Vulnerability from cvelistv5 – Published: 2024-11-05 16:22 – Updated: 2024-11-05 19:32
VLAI?
Title
Certain Poly Video Conference Devices – Potential Remote Code Execution
Summary
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
Severity ?
7.5 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| HP, Inc. | Certain Poly Video Conference Devices |
Affected:
See HP security bulletin reference for affected versions
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:poly:tc8_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tc8_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "6.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:tc10_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tc10_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "6.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:g7500_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "g7500_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x30_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x30_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x50_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x50_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x70_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x70_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x52_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x52_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_g62_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_g62_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T19:13:45.885761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:32:25.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Certain Poly Video Conference Devices",
"vendor": "HP, Inc.",
"versions": [
{
"status": "affected",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.\u003c/span\u003e"
}
],
"value": "A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T16:22:01.465Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_11536495-11536533-16/hpsbpy03900"
}
],
"source": {
"advisory": "HPSBPY03900",
"discovery": "UNKNOWN"
},
"title": "Certain Poly Video Conference Devices \u2013 Potential Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-9579",
"datePublished": "2024-11-05T16:22:01.465Z",
"dateReserved": "2024-10-07T13:24:15.881Z",
"dateUpdated": "2024-11-05T19:32:25.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9579 (GCVE-0-2024-9579)
Vulnerability from nvd – Published: 2024-11-05 16:22 – Updated: 2024-11-05 19:32
VLAI?
Title
Certain Poly Video Conference Devices – Potential Remote Code Execution
Summary
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
Severity ?
7.5 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| HP, Inc. | Certain Poly Video Conference Devices |
Affected:
See HP security bulletin reference for affected versions
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:poly:tc8_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tc8_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "6.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:tc10_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tc10_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "6.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:g7500_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "g7500_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x30_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x30_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x50_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x50_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x70_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x70_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x52_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x52_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_g62_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_g62_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T19:13:45.885761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:32:25.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Certain Poly Video Conference Devices",
"vendor": "HP, Inc.",
"versions": [
{
"status": "affected",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.\u003c/span\u003e"
}
],
"value": "A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T16:22:01.465Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_11536495-11536533-16/hpsbpy03900"
}
],
"source": {
"advisory": "HPSBPY03900",
"discovery": "UNKNOWN"
},
"title": "Certain Poly Video Conference Devices \u2013 Potential Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-9579",
"datePublished": "2024-11-05T16:22:01.465Z",
"dateReserved": "2024-10-07T13:24:15.881Z",
"dateUpdated": "2024-11-05T19:32:25.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}