Skip to content
Fencer Vulns
medium 4.9

CVE-2025-14432 json

Poly Video - Sensitive Data Might Be Written to Log File

published 2025-12-16 10 mo ago modified 2026-10-07 32 d ago also EUVD-2025-203769

cvss
4.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.

Patch / fix

  • HP Inc Poly G7500 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio G62 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio X72 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio X52 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio X32 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio X70 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio X50 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio X30 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio E70 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio E60 <PolyOS 4.6.1-444242
  • HP Inc Poly EagleEye Cube <PolyOS 4.6.1-444242
  • HP Inc Polycom EagleEye IV <PolyOS 4.6.1-444242
  • HP Inc Poly Studio A2 <PolyOS 4.6.1-444242
  • HP Inc Poly Studio USB <PolyOS 4.6.1-444242
  • HP Inc TC8 <TCOS 6.6.1-7001859
  • HP Inc TC10 <TCOS 6.6.1-7001859

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
10 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA 4.0 8.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

  • HP Inc Poly G7500
  • HP Inc Poly Studio G62
  • HP Inc Poly Studio X72
  • HP Inc Poly Studio X52
  • HP Inc Poly Studio X32
  • HP Inc Poly Studio X70
  • HP Inc Poly Studio X50
  • HP Inc Poly Studio X30
  • HP Inc Poly Studio E70
  • HP Inc Poly Studio E60
  • HP Inc Poly EagleEye Cube
  • HP Inc Polycom EagleEye IV
  • HP Inc Poly Studio A2
  • HP Inc Poly Studio USB
  • HP Inc TC8
  • HP Inc TC10

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.