EUVD-2025-21033Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
7DescriptionCVE.org
An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.
AnalysisAI
Polycom HDX Series video conferencing systems contain an authenticated command injection in the LAN traceroute function. The devcmds console accessible over Telnet allows injection of shell metacharacters through the traceroute target parameter, enabling arbitrary command execution on the conferencing endpoint.
Technical ContextAI
The devcmds console accessible via Telnet provides network diagnostic commands. The lan traceroute command passes the target parameter to a system call without sanitization. An attacker with Telnet credentials can inject shell commands that execute on the Polycom device's underlying Linux system.
RemediationAI
Disable Telnet access and use SSH. Change default credentials. Isolate video conferencing endpoints on a dedicated VLAN. Monitor Telnet/SSH access logs for unauthorized logins.
Share
External POC / Exploit Code
Leaving vuln.today