Threats tagged 'ghsa-9wmg-r53f-j9fq'

A command injection vulnerability exists in an API function of the management service on HP Poly EagleEye Cube USB 1.3.1-001267 devices. This flaw allows attackers without administrator privileges to execute arbitrary commands as root by exploiting insufficient input validation during the CSR certificate generation process. Successful exploitation grants full root access, enabling complete control over device operations, unauthorized data access, and the potential to install persistent backdoors that could operate via the Ethernet port.