HP Poly VideoOS CVE-2025-14432

Exploitation requires all of: (1) the device is an HP Poly VideoOS or Poly TCOS endpoint managed in Teams mode; (2) an administrator makes device configuration changes specifically through Microsoft Teams Admin Center (TAC) - the flaw does NOT trigger for changes made via the provisioning server or the device WebUI; and (3) the observer holds admin credentials, since the affected log file is visible only to administrators. The disclosure only happens 'in limited scenarios' during such TAC-driven config changes (UI:A), and the pre-existing admin restriction on the log (PR:H) sharply limits who can access the leaked data.

This is a genuine but modest-priority information-disclosure issue whose real-world risk is well below what the 8.1 headline score suggests. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/SC:H) is inflated by VC:H+SC:H, but two strong limiting factors cut the practical risk: PR:H means only a user who already holds admin credentials can read the affected log, and UI:A means the disclosure only occurs as an active consequence of an admin performing device configuration changes through Microsoft Teams Admin Center. In other words, the party who could read the leaked data is already a privileged admin - this is primarily a data-hygiene/privilege-boundary concern (secrets landing in a log where a lower-tier admin or log-forwarding pipeline could read them) rather than a remote-takeover flaw. EPSS is low at 0.40% (32nd percentile), there is no CISA KEV listing and no public exploit, consistent with a low-automatability, precondition-heavy issue. Note a scope/labeling tension: the description frames the leak as limited ('in limited scenarios', 'admin-only log'), which sits awkwardly with the vendor's VC:H/SC:H - the impact rating likely assumes the logged secrets are credentials or config material for other systems (justifying subsequent-system impact), but this is not spelled out and should be verified against the HP advisory. The 'Microsoft' association is only because the device is a Teams endpoint managed via TAC; the affected product is HP Poly firmware, not a Microsoft product.

An operator with admin rights configures a Poly VideoOS/TCOS Teams device through Microsoft Teams Admin Center, and in limited scenarios the change causes sensitive configuration data to be written into a device log file. A second party with admin credentials - or an automated log-collection/SIEM pipeline that ingests that admin-only log - later reads the exposed data and reuses it. No public exploit code exists and the attack requires existing administrative access plus an admin-initiated configuration action.