CVE-2015-8300

Polycom BToE Connector before 3.0.0 uses weak permissions Everyone: Full Control for "Program Files x86\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file...

CVE-2015-8300

Polycom BToE Connector (pre-3.0.0) exposes weak permissions (Everyone: Full Control) on the file plcmbtoesrv.exe, enabling local privilege escalation via a Trojan horse/file replacement. Multiple sources corroborate that versions prior to 3.0.0 are affected; fixed in version 3.0.0 released March ...

CVE-2015-8300

Polycom BToE Connector before 3.0.0 uses weak permissions Everyone: Full Control for "Program Files x86\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file...

CVE-2015-8300: Undefined Security Weakness

Polycom BToE Connector before 3.0.0 uses weak permissions Everyone: Full Control for "Program Files x86\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

Information disclosure

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

CVE-2017-12857

Polycom devices (SoundStation IP, VVX, RealPresence Trio) running UCS versions older than 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by an information-disclosure vulnerability in the UCS web application. An authenticated remote attacker could read memory segments containing adminis...

CVE-2017-12857: Exposure of Sensitive Information to an Unauthorized Actor

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

R7-2017-07: Multiple Fuze TPN Handset Portal vulnerabilities (FIXED)

This post describes three security vulnerabilities related to access controls and authentication in the TPN Handset Portal, part of the Fuze platform. Fuze fixed all three issues by May 6, 2017, and user action is not required to remediate. Rapid7 thanks Fuze for their quick and thoughtful respon...

Polycom VVX Web Interface Privilege Escalation

Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html Version: Polycom vvx 410 UC Software Version: 5.3.1.04...

Polycom VVX Web Interface Forced Admin Password Change Vulnerability

Polycom is a global leader in standards-based unified communications UC solutions for telepresence, video and voice. The Polycom VVX web interface can be forced to change the admin password vulnerability, which requires a user to access the "user" account in the web interface of a Polycom VoIP...

Polycom VVX Web Interface - Change Admin Password

Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html Version: Polycom vvx 410 UC Software Version: 5.3.1.04...

Polycom VVX Web Interface - Change Admin Password

Polycom VVX Web Interface - Change Admin Password Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html...

Polycom VVX Web Interface - Change Admin Password Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link:...

Unauthorized Access Vulnerability in Polycom HDX Series Video Conferencing Systems

The Polycom HDX Series of products are multipoint video conferencing system servers that provide easy-to-manage multipoint video and integrated conferencing services for next-generation real-time media conferencing platforms. An unauthorized access vulnerability exists in the Polycom HDX Series...

OpenSSL Memory Leak Vulnerability in Polycom HDX Series Video Conferencing Systems

The Polycom HDX Series of products are multipoint video conferencing system servers that provide easy-to-manage multipoint video and integrated conferencing services for next-generation real-time media conferencing platforms. An OpenSSL memory leak vulnerability exists in the Polycom HDX Series...

Unspecified Cross-Site Scripting Vulnerability in Polycom HDX Video End Points

Polycom HDX Video End Points video conferencing system. An unspecified cross-site scripting vulnerability exists in Polycom HDX Video End Points. The vulnerability can be exploited to execute arbitrary HTML and script code in the browsers of trusted users in the context of an affected site, steal...