Medium severity · published Dec 29, 2023
CVE-2023-4462
Poly VVX 601 Web Configuration Application random values
5.9
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C3
CCX 350 · Poly
All versions, or not specified · source: vendor
C4
CCX 400 · Poly
All versions, or not specified · source: vendor
C5
CCX 500 · Poly
All versions, or not specified · source: vendor
C5
CCX 505 · Poly
All versions, or not specified · source: vendor
C6
CCX 600 · Poly
All versions, or not specified · source: vendor
C7
CCX 700 · Poly
All versions, or not specified · source: vendor
EE
EDGE E100 · Poly
All versions, or not specified · source: vendor
EE
EDGE E220 · Poly
All versions, or not specified · source: vendor
EE
EDGE E300 · Poly
All versions, or not specified · source: vendor
EE
EDGE E320 · Poly
All versions, or not specified · source: vendor
EE
EDGE E350 · Poly
All versions, or not specified · source: vendor
EE
EDGE E400 · Poly
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4462
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4462
Not Applicable
https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
github.com
https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices
modzero.com
https://modzero.com/en/advisories/mz-23-01-poly-voip/
support.hp.com
https://support.hp.com/us-en/document/ish_9929296-9929329-16/hpsbpy03896
Permissions Required
https://vuldb.com/?ctiid.249255
Third Party Advisory
https://vuldb.com/?id.249255
More from CCX 350
7.2
CVE-2023-4464
Poly VVX 601 Diagnostic Telnet Mode os command injection
6.5
CVE-2023-4465
Poly VVX 601 Configuration File Import unverified password change
