CVE-2026-39431: Input Validation
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).
Event History
Frequently Asked Questions
Who is exposed to this issue?
HP Poly EagleEye Cube USB devices running version 1.3.1-001267 are affected. The vulnerable management service is accessible through USB.
What does an attacker need to exploit it?
An attacker needs access to the USB-accessible management service and does not need administrator-level access. They can exploit insufficient validation in certificate signing request generation to inject commands.
What is the impact of successful exploitation?
Successful exploitation allows arbitrary commands to run as root, giving full control of device operations and potential unauthorized access to data. An attacker could also install a persistent backdoor that operates through the Ethernet port.