CVE-2023-4464

A vulnerability, which was classified as critical, has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This issue affects some unknown processing of the component Diagnostic Telnet Mode. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:poly:ccx_400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:ccx_400:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:poly:ccx_600_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:ccx_600:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:poly:trio_8800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:trio_8800:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:poly:trio_c60_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:trio_c60:-:*:*:*:*:*:*:*

History

21 Nov 2024, 08:35

Type Values Removed Values Added
References () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html - Not Applicable () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html - Not Applicable
References () https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices - () https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices -
References () https://modzero.com/en/advisories/mz-23-01-poly-voip/ - () https://modzero.com/en/advisories/mz-23-01-poly-voip/ -
References () https://support.hp.com/us-en/document/ish_9931565-9931594-16/hpsbpy03898 - () https://support.hp.com/us-en/document/ish_9931565-9931594-16/hpsbpy03898 -
References () https://vuldb.com/?ctiid.249257 - Permissions Required, Third Party Advisory, VDB Entry () https://vuldb.com/?ctiid.249257 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.249257 - Third Party Advisory, VDB Entry () https://vuldb.com/?id.249257 - Third Party Advisory, VDB Entry

05 Jan 2024, 18:04

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.2
CPE cpe:2.3:o:poly:trio_8800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:poly:ccx_600_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:poly:trio_c60_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:ccx_600:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:trio_8800:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:ccx_400:-:*:*:*:*:*:*:*
cpe:2.3:h:poly:trio_c60:-:*:*:*:*:*:*:*
cpe:2.3:o:poly:ccx_400_firmware:-:*:*:*:*:*:*:*
References () https://vuldb.com/?id.249257 - () https://vuldb.com/?id.249257 - Third Party Advisory, VDB Entry
References () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html - () https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html - Not Applicable
References () https://vuldb.com/?ctiid.249257 - () https://vuldb.com/?ctiid.249257 - Permissions Required, Third Party Advisory, VDB Entry
References () https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/ - () https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/ - Broken Link

29 Dec 2023, 13:56

Type Values Removed Values Added
New CVE

Information

Published : 2023-12-29 10:15

Updated : 2024-11-21 08:35


NVD link : CVE-2023-4464

Mitre link : CVE-2023-4464

CVE.ORG link : CVE-2023-4464


JSON object : View

Products Affected

poly

  • trio_c60
  • trio_c60_firmware
  • ccx_600_firmware
  • ccx_600
  • trio_8800
  • ccx_400_firmware
  • trio_8800_firmware
  • ccx_400
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')