Poly Videoos
Monthly
Sensitive configuration data can be written into a local log file on HP Poly VideoOS and Poly TCOS endpoints when an administrator changes device settings through the Microsoft Teams Admin Center (TAC) interface. The exposure is narrow by design: the affected log is readable only by users holding administrator credentials, and the flaw does not trigger when the same configuration changes are made through the provisioning server or the device WebUI. No public exploit code has been identified at time of analysis and EPSS is low (0.40%, 32nd percentile), but the CVSS 8.1 base score overstates operational risk - the prerequisite of administrator-level access to the log sharply constrains who could actually read the leaked data, consistent with our independent assessment of a modest-priority information-disclosure issue.
Sensitive configuration data can be written into a local log file on HP Poly VideoOS and Poly TCOS endpoints when an administrator changes device settings through the Microsoft Teams Admin Center (TAC) interface. The exposure is narrow by design: the affected log is readable only by users holding administrator credentials, and the flaw does not trigger when the same configuration changes are made through the provisioning server or the device WebUI. No public exploit code has been identified at time of analysis and EPSS is low (0.40%, 32nd percentile), but the CVSS 8.1 base score overstates operational risk - the prerequisite of administrator-level access to the log sharply constrains who could actually read the leaked data, consistent with our independent assessment of a modest-priority information-disclosure issue.