What is the CVSS score of CVE-2024-9579?

CVE-2024-9579 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Poly Tc8 Firmware CVE-2024-9579

HIGH

Command Injection (CWE-77)

2024-11-05 hp-security-alert@hp.com

Command Injection Poly Tc8 Firmware Poly Tc10 Firmware Poly Studio G7500 Firmware Poly Studio X30 Firmware Poly Studio X50 Firmware Poly Studio X70 Firmware Poly Studio X52 Firmware Poly Studio G62 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 05, 2024 - 17:15 nvd

HIGH 7.5

DescriptionNVD

A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.

AnalysisAI

A potential vulnerability was discovered in certain Poly video conferencing devices. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself. Affected products include: Hp Poly Tc8 Firmware, Hp Poly Tc10 Firmware, Hp Poly Studio G7500 Firmware, Hp Poly Studio X30 Firmware, Hp Poly Studio X50 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.