CVE-2023-4466 Poly CCX 400/CCX 600/Trio 8800/Trio C60 Web Interface protection mechanism

Low 2.7 Published 29 Dec 2023 Updated 2 Aug 2024

Attackers can bypass protection mechanisms in Poly conference phone web interfaces, potentially enabling roll-back attacks to vulnerable firmware versions.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-4466?

CVE-2023-4466 is a low-severity vulnerability in Poly CCX 400, published on 29 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.

Weakness: CWE-693

Which versions are affected by CVE-2023-4466?

It affects 4 products.

Products include Poly Ccx 400 Firmware, Poly Ccx 600 Firmware, Poly Trio 8800 Firmware, Poly Trio C60 Firmware.

How do I fix CVE-2023-4466?

No fix has been published for CVE-2023-4466 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-4466 being exploited?

There is no known exploitation of CVE-2023-4466 in the wild and no public exploit code.

Sources

Also known as GHSA-38xw-jx8m-w5wp.