---
id: CVE-2026-39431
title: >-
  On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions
  available on a management service accessible via USB allows command injection
summary: >-
  On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions
  available on a management service accessible via USB allows command injection.
  This allows attackers (without administrator-level access) to execute
  arbitrary co…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T18:47:46.729393Z'
published: '2026-11-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:48:25.450Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-39431'
references:
  - url: >-
      https://support.hp.com/rs-en/product/product-specs/g7500-kit-series/model/2102186752
  - url: 'https://docs.poly.com/bundle/eagleeye-cube-usb-ug-1-3-0/page/t2821658.html'
  - url: >-
      https://github.com/thackeraaron/polycom_research/blob/main/CVE-2026-39430_and_CVE-2026-39431.md
tags:
  - cve.org
epss: 0.01023
epssPercentile: 0.63699
ingestedAt: '2026-11-05T20:33:06.745Z'
---

## Overview

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.