On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified client that bypasses the login step or via a custom client to make the underlying administrator API calls. This allows unauthenticated users to perform administrative actions too such as exporting configuration files that include the internal device credentials for the administrator user and other network systems.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 04 Nov 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified client that bypasses the login step or via a custom client to make the underlying administrator API calls. This allows unauthenticated users to perform administrative actions too such as exporting configuration files that include the internal device credentials for the administrator user and other network systems. | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-11-04T14:14:17.187Z
Reserved: 2026-04-07T00:00:00.000Z
Link: CVE-2026-39430
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.