PT-2023-8565 · Poly · Poly Trio 8500+3

Christoph Wolff + 1 · Published 2023-12-29 · Updated 2024-05-17 · CVE-2023-4468

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Poly Trio 8500 version unknown Poly Trio 8800 version unknown Poly Trio C60 version unknown

Description A vulnerability was found in the Poly Lens Management Cloud Registration component, affecting an unknown part of it. The manipulation leads to missing authorization, and it is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. This issue is related to deficiencies in the authorization procedure of the Poly Lens application interface for Poly Trio phones and acoustic systems for conference calls.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-01180

CVE-2023-4468

Affected Products

Poly Lens

Poly Trio 8500

Poly Trio 8800

Poly Trio C60

References · 12

• 🔥 https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-4468 · Security Note
• https://bdu.fstec.ru/vul/2024-01180 · Security Note
• https://twitter.com/CVEnew/status/1740672084848881695 · Twitter Post
• https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html · Note
• https://modzero.com/en/advisories/mz-23-01-poly-voip · Note
• https://modzero.com/en/blog/multiple-vulnerabilities-in-poly-products · Note
• https://vuldb.com/?ctiid.249261 · Note
• https://support.hp.com/us-en/document/ish_9929447-9929472-16/hpsbpy03902 · Note
• https://t.me/cvenotify/66479 · Telegram Post
• https://t.me/cibsecurity/73935 · Telegram Post
• https://vuldb.com/?id.249261 · Note