Poly CCX 400/CCX 600/Trio 8800/Trio C60 Web Interface protection mechanism
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-693.
Summary
A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Poly | CCX 400 | all versions | — | No fix listed | CNA |
| Poly | CCX 600 | all versions | — | No fix listed | CNA |
| Poly | Trio 8800 | all versions | — | No fix listed | CNA |
| Poly | Trio C60 | all versions | — | No fix listed | CNA |
- CCX 400 VendorPoly Affected all versions Fixed in — No fix listed CNA
- CCX 600 VendorPoly Affected all versions Fixed in — No fix listed CNA
- Trio 8800 VendorPoly Affected all versions Fixed in — No fix listed CNA
- Trio C60 VendorPoly Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:poly:ccx_400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Poly |
| cpe:2.3:h:poly:ccx_400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Poly |
| cpe:2.3:o:poly:ccx_600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Poly |
| cpe:2.3:h:poly:ccx_600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Poly |
| cpe:2.3:o:poly:trio_8800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Poly |
| cpe:2.3:h:poly:trio_8800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Poly |
| cpe:2.3:o:poly:trio_c60_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Poly |
| cpe:2.3:h:poly:trio_c60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Poly |
- cpe:2.3:o:poly:ccx_400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Poly
- cpe:2.3:h:poly:ccx_400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Poly
- cpe:2.3:o:poly:ccx_600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Poly
- cpe:2.3:h:poly:ccx_600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Poly
- cpe:2.3:o:poly:trio_8800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Poly
- cpe:2.3:h:poly:trio_8800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Poly
- cpe:2.3:o:poly:trio_c60_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Poly
- cpe:2.3:h:poly:trio_c60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Poly
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4466
- 2026-10-03 Alias added: GHSA-38xw-jx8m-w5wp
References
More Poly Ccx 400 Firmware vulnerabilities
- TI-2023-04121 Poly VVX 601 Diagnostic Telnet Mode os command injection CVSS 3.1HIGH 7.2
- TI-2023-04120 Poly CCX 400/CCX 600/Trio 8800/Trio C60 HTTP Header denial of service CVSS 3.1HIGH 7.5
- TI-2023-04122 Poly VVX 601 Configuration File Import unverified password change CVSS 3.1MEDIUM 6.5
- TI-2023-04119 Poly VVX 601 Web Configuration Application random values CVSS 3.1MEDIUM 5.9
Sources
- CVE-2023-4466 · CVE Program
- CVE-2023-4466 · NVD
- FIRST EPSS
- GHSA-38xw-jx8m-w5wp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences