Link following in Poly Plantronics Hub
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Spokes Update Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18271.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Poly | Plantronics Hub | 3.24.2 Build 36336 | — | No fix listed | CNA |
- Plantronics Hub VendorPoly Affected 3.24.2 Build 36336 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:poly_plantronics_hub:3.24.2:*:*:*:*:*:*:* | 3.24.2 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:poly_plantronics_hub:3.24.2:*:*:*:*:*:*:* Versions 3.24.2 Vulnerable ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6147
- 2026-10-03 Alias added: GHSA-mpmm-q7jf-hx4p
References
Advisory 1
More Poly vulnerabilities
- TI-2022-09828 An issue was discovered in Poly EagleEye Director II before 2.2.2.1. CVSS 3.1HIGH 7.2
- TI-2022-09826 An issue was discovered in Poly EagleEye Director II before 2.2.2.1. CVSS 3.1CRITICAL 9.8
- TI-2018-12709 A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices… CVSS 3.1HIGH 8.8
- TI-2022-09827 An issue was discovered in Poly Studio before 3.7.0. CVSS 3.1HIGH 8.8
- TI-2023-04121 Poly VVX 601 Diagnostic Telnet Mode os command injection CVSS 3.1HIGH 7.2
- TI-2021-15211 A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly… CVSS 3.1HIGH 7.2
Sources
- CVE-2024-6147 · CVE Program
- CVE-2024-6147 · NVD
- FIRST EPSS
- GHSA-mpmm-q7jf-hx4p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences