HP Poly EagleEye Cube USB 1.3.1-001267 Management Service command injection

Summaryinfo

A vulnerability was found in HP Poly EagleEye Cube USB 1.3.1-001267. It has been rated as very critical. This affects an unknown part of the component Management Service. The manipulation leads to command injection. This vulnerability is documented as CVE-2026-39431. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in HP Poly EagleEye Cube USB 1.3.1-001267. It has been rated as very critical. This issue affects an unknown function of the component Management Service. The manipulation with an unknown input leads to a command injection vulnerability. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).

The advisory is shared at support.hp.com. The identification of this vulnerability is CVE-2026-39431 since 04/07/2026. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/04/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• HP Poly

Name

• EagleEye Cube USB

Version

• 1.3.1-001267

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion