CVE-2023-4466 json
Poly CCX 400/CCX 600/Trio 8800/Trio C60 Web Interface protection mechanism
published 2023-12-29 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-54321
- cvss
- 2.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 2.7 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 3.3 | AV:N/AC:L/Au:M/C:N/I:P/A:N |
| NVD | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
Affected products
- Poly CCX 400
- Poly CCX 600
- Poly Trio 8800
- Poly Trio C60
Classification
- Weakness
-
- CWE-693 Protection Mechanism Failure
References
-
github.com
/modzero/MZ-23-01-Poly-VoIP-Devices
exploit
-
vuldb.com
/?id.249259
vdb-entry, third-party-advisory
-
vuldb.com
/?ctiid.249259
signature, permissions-required, third-party-advisory, vdb-entry
-
modzero.com
/en/advisories/mz-23-01-poly-voip/
related
-
fahrplan.events.ccc.de
/congress/2023/fahrplan/events/11919.html
related, not-applicable
Sources
- CVE List CVE-2023-4466
- NVD CVE-2023-4466
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.