Command injection

Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...

Directory traversal

Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...

CVE-2012-6609

CVE-2012-6609 is a directory traversal in Polycom HDX Video Endpoints (before 3.0.4) and UC APL (before 2.7.1.J). An attacker can read arbitrary files by supplying .. in the name parameter via a_getlog.cgi. The NVD entry reports CVSSv2 base score 5.0 (MEDIUM) and CVSSv3.1 base score 7.5 (HIGH), w...

CVE-2012-6609

Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...

CVE-2012-6610

CVE-2012-6610 affects Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J. The vulnerability is a command injection that allows remote authenticated users to execute arbitrary commands via the ping feature, demonstrated by using a semicolon to inject commands. Evidence from multip...

CVE-2012-6610

Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...

CVE-2012-6610: Improper Neutralization of Special Elements used in an OS Command

Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; semicolon to the ping command feature...

CVE-2012-6609: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in agetlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitrary files via a .. dot dot in the name parameter...

HDX sessions with CWA for HTML5 have a noticeable delay when launching.

Launching a HDX session with theCWA for HTML5 client shows a delay of several seconds. Issue is only seen on client machines with no internet access. Issue only seen with latest HTML5 client - probably version 1909 onwards. Browser logs show that a connection attempt to googletagmanager.com. On...

Troubleshooting HDX Optimization for Microsoft Teams

This is a Live article - updated frequently with the latest info and known issues ------------------------------------------------------------------------------------------------------------------------------------------------- Recommended Teams version :latest version. Update history for...

Codec H.265 not working in HDX session

H.265 not getting utilized in the HDX session with the below settings: Followed the link: https://docs.citrix.com/en-us/receiver/windows/current-release/improve/h-265-video-encoding.html Studio Policy set: 1. Graphic Status indicator - Disabled 2. Moving Image Compression - Disabled 3. Optimize...

Remote code execution

An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets...

CVE-2018-15128

An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets...

CVE-2018-15128

An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets...

CVE-2018-15128

CVE-2018-15128 affects Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. The issue is a remote code execution in the content sharing feature caused by a buffer overflow triggered by crafted packets. The available documents identify the products and vuln...

CVE-2018-15128: Improper Restriction of Operations within the Bounds of a Memory Buffer

An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets...

Polycom HDX Operating System Command Injection Vulnerability

Polycom HDX is a high-definition video conferencing system from Polycom. A security vulnerability exists in Polycom HDX. An attacker could exploit the vulnerability to execute system commands with root privileges...

Lifecycle Information for HDX RealTime Optimization Pack

The HDX RealTime Optimization Pack RTOP for Skype® for Business is a feature of Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop, Advanced formerly Enterprise and Premium formerly Platinum editions. HDX RTOP provides optimized delivery of the Microsoft Skype for Business 2015, 2016...

Delivering Softphones with Virtual Apps and Desktops

This article describes a generic approach to delivering softphones and voice chat applications with Citrix Virtual Apps and Desktops CVAD7.x. 1. Alternatives for Delivering Softphones CVADsupport several alternatives for delivering softphones. Control mode , where the hosted published softphone i...

CVE-2012-6610

creationtimestamp| type| source ---|---|--- 2018-11-05 22:04:13+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/misc/polycomhdxauthbypass.rb 2025-10-23 21:12:57+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7 2026-09-08 06:50:38+00:00| seen|...