Lucene search

VulDBCVE-2023-4467

HistoryDec 29, 2023 - 10:15 a.m.

CVE-2023-4467

2023-12-2910:15:12

CWE-912

VulDB

web.nvd.nist.gov

cve-2023-4467

poly trio 8800

test automation mode

backdoor

vulnerability

nvd

vdb-249260

CVSS2

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:M/C:C/I:C/A:C

CVSS3

6.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.3

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260.

Affected configurations

Nvd

Vulners

Node

polytrio_8800_firmwareMatch7.2.6.0019

AND

polytrio_8800Match-

VendorProductVersionCPE
polytrio_8800_firmware7.2.6.0019cpe:2.3:o:poly:trio_8800_firmware:7.2.6.0019:*:*:*:*:*:*:*
polytrio_8800-cpe:2.3:h:poly:trio_8800:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
poly	trio_8800_firmware	7.2.6.0019	cpe:2.3:o:poly:trio_8800_firmware:7.2.6.0019:::::::*
poly	trio_8800	-	cpe:2.3:h:poly:trio_8800:-:::::::*

CNA Affected

[
  {
    "vendor": "Poly",
    "product": "Trio 8800",
    "versions": [
      {
        "version": "7.2.6.0019",
        "status": "affected"
      }
    ],
    "modules": [
      "Test Automation Mode"
    ]
  }
]

References

fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html

github.com/modzero/MZ-23-01-Poly-VoIP-Devices

modzero.com/en/advisories/mz-23-01-poly-voip/

vuldb.com/?ctiid.249260

vuldb.com/?id.249260

CVSS2

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:M/C:C/I:C/A:C

CVSS3

6.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.3

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-4467