PT-2024-2967 · Poly · Poly Ccx

Moritz Abrell · Published 2024-04-04 · Updated 2024-11-20 · CVE-2024-3281

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Poly CCX devices versions 8.0.2.3267 through 8.1.3.1301

Description The issue is related to a flaw in the firmware build process that did not properly restrict access to a resource from an unauthorized actor. This flaw is associated with deficiencies in the authorization procedure, which could allow an attacker to elevate their privileges.

Recommendations For versions 8.0.2.3267 through 8.1.3.1301, update to a version after 8.1.3.1301 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Exploit

Fix

Improper Authorization

Missing Authentication

Weakness Enumeration

CWE-285

CWE-306

Related Identifiers

BDU:2024-03134

CVE-2024-3281

Affected Products

Poly Ccx

References · 7

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-003.txt · Exploit
• https://bdu.fstec.ru/vul/2024-03134 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3281 · Security Note
• https://support.hp.com/us-en/document/ish_10388650-10388701-16/hpsbpy03929 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-3281 · Vendor Advisory
• https://t.me/cvenotify/76184 · Telegram Post
• https://twitter.com/CVEnew/status/1777722858061320291 · Twitter Post