{"id":"CVE-2026-39431","kind":"vulnerability","aliases":["CVE-2026-39431"],"related":[],"title":"HP Poly EagleEye Cube: USB management API lets attackers run root commands","description":"On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).","summary":"On HP Poly EagleEye Cube USB 1.3.1-001267 devices, an API function on a USB-accessible management service fails to validate input during CSR certificate generation, allowing command injection. An attacker without administrator access can run arbitrary commands as root, gaining full device control and the ability to plant a persistent backdoor.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Poly EagleEye Cube USB","fixed":[],"affected":"1.3.1-001267","ecosystem":"vendor"}],"ecosystems":[],"tags":["eagleeye-cube","firmware","hp-poly","infrastructure","usb-devices"],"not_affected_if":["usb-management-not-reachable"],"how_to_check":"Check the EagleEye Cube firmware version (device admin UI or the host room system's peripheral list) against 1.3.1-001267. Also check whether untrusted hosts or users can reach the camera's USB port or management service. No HP bulletin or fixed firmware found as of 2026-11-04.","fix":null,"status":"open","published_at":"2026-11-04T15:17:44+00:00","first_seen_at":"2026-11-04T15:27:32+00:00","triaged_at":"2026-11-04T15:28:32+00:00","updated_at":"2026-11-04T15:32:28+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-04T15:28:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"HP Poly EagleEye Cube: USB management API lets attackers run root commands","impact":"high","summary":"On HP Poly EagleEye Cube USB 1.3.1-001267 devices, an API function on a USB-accessible management service fails to validate input during CSR certificate generation, allowing command injection. An attacker without administrator access can run arbitrary commands as root, gaining full device control and the ability to plant a persistent backdoor.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hp-poly","eagleeye-cube","usb-devices","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs root commands and plants a persistent backdoor on the device","analyst_note":"Find the vendor advisory and the fixed firmware version; the NVD entry gives no fix or CVSS score.","how_to_check":"- Check the device firmware version in the device's admin or management interface against `1.3.1-001267`.\n- Determine whether the USB management service is reachable from untrusted hosts or users.","plain_action":"","needs_analyst":true,"not_affected_if":["usb-management-not-reachable"],"who_is_affected":"Organizations running HP Poly EagleEye Cube USB devices on firmware 1.3.1-001267 are exposed, since the flaw is reachable through the device's USB management service. Exposure depends on whether untrusted users or hosts can connect to that USB interface. The sources do not say which other firmware versions are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4193,"output_tokens":583,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed firmware version; the NVD entry gives no fix or CVSS score.","search":"'-001267':41B,94C '-2026':14A,17A '-39431':15A,18A '1.3.1':40B,93C 'abil':81B,167C 'access':50B,68B,106C,119C,153C,162C 'administr':67B,117C 'administrator-level':116C 'allow':61B,109C,113C,137C 'api':7A,44B,99C 'arbitrari':71B,122C 'attack':9A,65B,114C,139C 'avail':101C 'backdoor':86B,172C 'certif':59B,146C 'command':12A,62B,72B,110C,123C 'control':78B,141C,157C 'could':177C 'csr':58B,145C 'cube':4A,21A,25B,38B,91C 'cve':13A,16A 'data':164C 'devic':33B,42B,77B,95C,126C,159C,175C 'due':131C 'eagleey':3A,24B,37B,90C 'eagleeye':20A 'eagleeye-cub':23B 'ethernet':181C 'execut':121C 'fail':53B 'firmwar':26B 'full':76B,151C,156C 'function':45B,100C 'gain':75B 'generat':60B,147C 'hp':1A,28B,35B,88C 'hp-poli':27B 'infrastructur':30B 'inject':63B,111C 'input':56B,134C 'insuffici':133C 'let':8A 'level':118C 'manag':6A,51B,104C 'one':96C 'oper':160C,178C 'part':142C 'permit':155C 'persist':85B,171C 'place':169C 'plant':83B 'poli':2A,29B,36B,89C 'poly':19A 'port':182C 'process':148C 'provid':150C 'root':11A,74B,128C,152C 'run':10A,70B 'servic':52B,105C 'unauthor':161C 'usb':5A,22A,32B,39B,49B,92C,108C 'usb-access':48B 'usb-devic':31B 'valid':55B,135C 'via':107C,179C 'without':66B,115C","nicknames":[],"mitigations":[],"who_affected":"Offices running Poly EagleEye Cube USB cameras on firmware 1.3.1-001267. Exposure depends on an attacker reaching the camera's USB management service; the CVE text says no administrator access is needed. Teams without this camera can skip it. No other models or versions are confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["eagleeyecubeusb","polyeagleeyecubeusb"],"ptokens":["cube","eagleeye","poly","usb"],"labels":["eagleeyecube","firmware","high","hppoly","infrastructure","usbdevices"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39431","severity":null,"published_at":"2026-11-04T15:17:44+00:00","modified_at":"2026-11-04T15:17:44+00:00","first_seen_at":"2026-11-04T15:27:32+00:00","fetched_at":"2026-11-04T15:27:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-39431:1678","url":null,"severity":null,"published_at":"2026-11-04T15:32:28+00:00","modified_at":"2026-11-04T15:32:28+00:00","first_seen_at":"2026-11-04T15:32:28+00:00","fetched_at":"2026-11-04T15:32:28+00:00","note":"No HP/Poly vendor bulletin found yet (searched HP security bulletins, Poly alert pages, CVE aggregators); only NVD/CNA text exists. Fix unknown; only 1.3.1-001267 is named. Revisit when HP publishes a bulletin; sibling CVE-2026-39430 is same product."}],"documents":[{"id":68009,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39431","title":"NVD: CVE-2026-39431","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}