CVE-2026-39430
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken…
- Risk score
- 66/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The administrator authentication flow on HP Poly EagleEye Cube USB 1.3.1-001267 devices is broken, allowing unauthenticated users to change administrator-level settings and export configuration files containing internal device credentials. This allows unauthenticated users to perform administrative actions.
- Affected
- {'products': ['HP Poly EagleEye Cube USB'], 'packages': [], 'versions': ['1.3.1-001267']}
- Fix
- Check the linked advisory for a fix, as none is provided in the record.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified client that bypasses the login step or via a custom client to make the underlying administrator API calls. This allows unauthenticated users to perform administrative actions too such as exporting configuration files that include the internal device credentials for the administrator user and other network systems.
Last activity 4 Nov 2026. Patch Forecast updates every hour.