CVE-2024-6147

2024-06-2020:15:20

CWE-59

[email protected]

web.nvd.nist.gov

poly plantronics hub

local privilege escalation

vulnerability

spokes update service

symbolic link

arbitrary code

zdi-can-18271

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.0%

JSON

Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Spokes Update Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18271.

CNA Affected

[
  {
    "vendor": "Poly",
    "product": "Plantronics Hub",
    "versions": [
      {
        "version": "3.24.2 Build 36336",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]