CVE-2025-14432 Poly Video - Sensitive Data Might Be Written to Log File
Admins using Microsoft Teams Admin Center may inadvertently expose sensitive data in log files accessible only to other administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-14432?
CVE-2025-14432 is a high-severity vulnerability in HP Inc Poly EagleEye Cube, published on 16 Dec 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.
Weakness: CWE-532
Which versions are affected by CVE-2025-14432?
It affects 2 products.
Products include Hp Poly Tcos, Hp Poly Videoos.
How do I fix CVE-2025-14432?
No fix has been published for CVE-2025-14432 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14432 being exploited?
There is no known exploitation of CVE-2025-14432 in the wild and no public exploit code.
Sources
Also known as GHSA-jr38-4278-53pj.