PT-2025-4747 · Polycom · Polycom Realpresence Group 500

Published 2025-02-03 · Updated 2025-02-03 · CVE-2025-22918

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Polycom RealPresence Group 500 versions <=20

Description The issue is related to insecure permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting in the leakage of sensitive user information.

Recommendations For Polycom RealPresence Group 500 versions <=20, consider disabling the automatic loading of cookies as a temporary workaround until a patch is available. Restrict access to administrator functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Information Disclosure

Weakness Enumeration

CWE-276

CWE-200

Related Identifiers

CVE-2025-22918

Affected Products

Polycom Realpresence Group 500

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-22918 · Security Note
• https://t.me/cvedetector/17135 · Telegram Post
• https://github.com/MinggongKs/Polycom/blob/main/README.md · Note
• https://twitter.com/CVEnew/status/1886523343437976031 · Twitter Post