PT-2021-8828 · Poly · Poly Trio 8800

Unkl4B · Published 2021-12-28 · Updated 2022-01-10 · CVE-2018-17875

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Poly Trio 8800 version 5.7.1.4145

Description A remote code execution issue in the ping command allows remote authenticated users to execute commands via unspecified vectors.

Recommendations For Poly Trio 8800 version 5.7.1.4145, consider disabling the ping command as a temporary workaround until a patch is available. Restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2018-17875

Affected Products

Poly Trio 8800

References · 5

• 🔥 http://unkl4b.github.io/Authenticated-RCE-in-Polycom-Trio-8800-pt-1 · Exploit
• https://osv.dev/vulnerability/CVE-2018-17875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17875 · Security Note
• https://t.me/cibsecurity/34707 · Telegram Post
• https://support.polycom.com/content/support/emea/emea/en/support/voice/polycom-trio/polycom-trio-8800.html · Note