Medium severity · published Jul 23, 2025
CVE-2025-43489
A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1
5.2
CVSS
0.3%
EPSS
No
On KEV
Description
A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deserialize untrusted data without validation. HP has addressed the issue in the latest software update.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Poly Clariti Manager · HP
before 10.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43489
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-43489
Vendor Advisory
https://support.hp.com/us-en/document/ish_12781425-12781447-16/hbsbpy04037
More from Poly Clariti Manager
9.8
CVE-2024-41912
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices
8.8
CVE-2024-41913
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices
7.2
CVE-2025-43022
A potential SQL injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1
6.8
CVE-2025-43487
A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2
6.8
CVE-2025-43020
A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2