POLY EAGLEEYE CUBE USB · CVE-2026-39431 · Infrastructure
NO FIX YET
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, an API function on a USB-accessible management service fails to validate input during CSR certificate generation, allowing command injection. An attacker without administrator access can run arbitrary commands as root, gaining full device control and the ability to plant a persistent backdoor.
first public Nov 4, 2026 · 2 sources
Running Poly EagleEye Cube USB? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Offices running Poly EagleEye Cube USB cameras on firmware 1.3.1-001267. Exposure depends on an attacker reaching the camera's USB management service; the CVE text says no administrator access is needed. Teams without this camera can skip it. No other models or versions are confirmed.
Not affected if usb-management-not-reachable
Who cares eagleeye-cube, firmware, hp-poly, usb-devices
1.3.1-001267No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).
This page as .md · .json · in your agent: get_signal("CVE-2026-39431")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.