CVE-2023-4465

Poly VVX 601 Configuration File Import unverified password change

State: Published
Severity: 2.7 Low
Published: Dec 29, 2023
Updated: Aug 2, 2024
Reserved: Aug 21, 2023

Description

A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	2.7 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N	VulDB
3.0	2.7 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:P/A:N	VulDB

Weaknesses

CWE-620 Unverified Password Change

Affected Products

Product	Versions
Trio 8300Poly	n/aAffected
Trio 8500Poly	n/aAffected
Trio 8800Poly	n/aAffected
Trio C60Poly	n/aAffected
CCX 350Poly	n/aAffected
CCX 400Poly	n/aAffected
CCX 500Poly	n/aAffected
CCX 505Poly	n/aAffected
CCX 600Poly	n/aAffected
CCX 700Poly	n/aAffected
EDGE E100Poly	n/aAffected
EDGE E220Poly	n/aAffected
EDGE E300Poly	n/aAffected
EDGE E320Poly	n/aAffected
EDGE E350Poly	n/aAffected
EDGE E400Poly	n/aAffected
EDGE E450Poly	n/aAffected
EDGE E500Poly	n/aAffected
EDGE E550Poly	n/aAffected
VVX 101Poly	n/aAffected
VVX 150Poly	n/aAffected
VVX 201Poly	n/aAffected
VVX 250Poly	n/aAffected
VVX 300Poly	n/aAffected
VVX 301Poly	n/aAffected
VVX 310Poly	n/aAffected
VVX 311Poly	n/aAffected
VVX 350Poly	n/aAffected
VVX 400Poly	n/aAffected
VVX 401Poly	n/aAffected
VVX 410Poly	n/aAffected
VVX 411Poly	n/aAffected
VVX 450Poly	n/aAffected
VVX 500Poly	n/aAffected
VVX 501Poly	n/aAffected
VVX 600Poly	n/aAffected
VVX 601Poly	n/aAffected

References

https://vuldb.com/?id.249258vdb-entrytechnical-description
https://vuldb.com/?ctiid.249258signaturepermissions-required
https://modzero.com/en/advisories/mz-23-01-poly-voip/related
https://support.hp.com/us-en/document/ish_9929371-9929407-16/hpsbpy03899related
https://github.com/modzero/MZ-23-01-Poly-VoIP-Devicesexploit
https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.htmlrelated

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.