CVE-2025-34093: Polycom HDX Series Telnet Command Injection via lan traceroute
An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34093?
CVE-2025-34093 is classified as a high severity vulnerability due to the potential for unauthorized command execution.
How do I fix CVE-2025-34093?
To mitigate CVE-2025-34093, it is recommended to disable Telnet access and apply any available vendor patches.
What systems are affected by CVE-2025-34093?
CVE-2025-34093 affects the Polycom HDX Series devices that utilize the command shell interface over Telnet.
What type of vulnerability is CVE-2025-34093?
CVE-2025-34093 is an authenticated command injection vulnerability allowing execution of arbitrary system commands.
Can CVE-2025-34093 be exploited remotely?
Yes, CVE-2025-34093 can be exploited remotely if an attacker has authenticated access to the Telnet interface.