EUVD-2025-21033
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Tags
Description
An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.
Analysis
Polycom HDX Series video conferencing systems contain an authenticated command injection in the LAN traceroute function. The devcmds console accessible over Telnet allows injection of shell metacharacters through the traceroute target parameter, enabling arbitrary command execution on the conferencing endpoint.
Technical Context
The devcmds console accessible via Telnet provides network diagnostic commands. The lan traceroute command passes the target parameter to a system call without sanitization. An attacker with Telnet credentials can inject shell commands that execute on the Polycom device's underlying Linux system.
Affected Products
['Polycom HDX Series']
Remediation
Disable Telnet access and use SSH. Change default credentials. Isolate video conferencing endpoints on a dedicated VLAN. Monitor Telnet/SSH access logs for unauthorized logins.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today