Lucene search

VulDBCVE-2023-4468

HistoryDec 29, 2023 - 10:15 a.m.

CVE-2023-4468

2023-12-2910:15:13

CWE-862

VulDB

web.nvd.nist.gov

cve-2023-4468

poly trio 8800

trio c60

poly lens management

cloud registration

vulnerability

authorization

attack

exploit

vdb-249261

nvd

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

25.5%

JSON

A vulnerability was found in Poly Trio 8500, Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability.

Affected configurations

Nvd

Node

polytrio_8800_firmwareMatch-

AND

polytrio_8800Match-

Node

polytrio_c60Match-

AND

polytrio_c60Match-

Node

polylensMatch-

VendorProductVersionCPE
polytrio_8800_firmware-cpe:2.3:o:poly:trio_8800_firmware:-:*:*:*:*:*:*:*
polytrio_8800-cpe:2.3:h:poly:trio_8800:-:*:*:*:*:*:*:*
polytrio_c60-cpe:2.3:h:poly:trio_c60:-:*:*:*:*:*:*:*
polylens-cpe:2.3:a:poly:lens:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
poly	trio_8800_firmware	-	cpe:2.3:o:poly:trio_8800_firmware:-:::::::*
poly	trio_8800	-	cpe:2.3:h:poly:trio_8800:-:::::::*
poly	trio_c60	-	cpe:2.3:h:poly:trio_c60:-:::::::*
poly	lens	-	cpe:2.3:a:poly:lens:-:::::::*

CNA Affected

[
  {
    "vendor": "Poly",
    "product": "Trio 8500",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ],
    "modules": [
      "Poly Lens Management Cloud Registration"
    ]
  },
  {
    "vendor": "Poly",
    "product": "Trio 8800",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ],
    "modules": [
      "Poly Lens Management Cloud Registration"
    ]
  },
  {
    "vendor": "Poly",
    "product": "Trio C60",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ],
    "modules": [
      "Poly Lens Management Cloud Registration"
    ]
  }
]

References

fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html

github.com/modzero/MZ-23-01-Poly-VoIP-Devices

modzero.com/en/advisories/mz-23-01-poly-voip/

modzero.com/en/blog/multiple-vulnerabilities-in-poly-products/

support.hp.com/us-en/document/ish_9929447-9929472-16/hpsbpy03902

vuldb.com/?ctiid.249261

vuldb.com/?id.249261

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

25.5%

JSON

Related for CVE-2023-4468