---
id: "CVE-2026-39431"
kind: "vulnerability"
aliases: ["CVE-2026-39431"]
title: "HP Poly EagleEye Cube: USB management API lets attackers run root commands"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Poly EagleEye Cube USB", "fixed": [], "affected": "1.3.1-001267", "ecosystem": "vendor"}]
ecosystems: []
tags: ["eagleeye-cube", "firmware", "hp-poly", "infrastructure", "usb-devices"]
not_affected_if: ["usb-management-not-reachable"]
published_at: "2026-11-04T15:17:44+00:00"
first_seen_at: "2026-11-04T15:27:32+00:00"
updated_at: "2026-11-04T15:32:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39431", "first_seen_at": "2026-11-04T15:27:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T15:32:28+00:00"}]
---

# HP Poly EagleEye Cube: USB management API lets attackers run root commands

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, an API function on a USB-accessible management service fails to validate input during CSR certificate generation, allowing command injection. An attacker without administrator access can run arbitrary commands as root, gaining full device control and the ability to plant a persistent backdoor.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Poly EagleEye Cube USB affected 1.3.1-001267 fixed ?

## How to check

Check the EagleEye Cube firmware version (device admin UI or the host room system's peripheral list) against 1.3.1-001267. Also check whether untrusted hosts or users can reach the camera's USB port or management service. No HP bulletin or fixed firmware found as of 2026-11-04.

## Timeline

- 2026-11-04T15:27:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39431
- 2026-11-04T15:32:28+00:00 analyst — No HP/Poly vendor bulletin found yet (searched HP security bulletins, Poly alert pages, CVE aggregators); only NVD/CNA text exists. Fix unknown; only 1.3.1-001267 is named. Revisit when HP publishes a bulletin; sibling CVE-2026-39430 is same product.

## Documents

- [describes] NVD: CVE-2026-39431 https://nvd.nist.gov/vuln/detail/CVE-2026-39431

## From the sources

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_