Read the docs
TI-2025-24254 Aliases CVE-2025-34093GHSA-hjrc-rmvc-q9q6

Polycom HDX Series Telnet Command Injection via lan traceroute

Priority HIGH 68CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02839 86th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA
Fix Fixed HDX Series (Polycom): 3.1.11 hotfix 2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PolycomHDX Seriesbefore 3.1.11 hotfix 23.1.11 hotfix 2Patch availableCNA
  • HDX Series VendorPolycom Affected before 3.1.11 hotfix 2 Fixed in 3.1.11 hotfix 2 Patch available CNA

Remediation

  • Fix · CNA HDX Series (Polycom) Fixed in 3.1.11 hotfix 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34093
  2. 2026-10-03 Alias added: GHSA-hjrc-rmvc-q9q6

References

Exploit 3

Patch 1

  • TI-2015-03921 Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain… CVSS 3.0CRITICAL 9.8
  • TI-2012-05328 Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote… CVSS 3.1HIGH 8.8
  • TI-2018-10822 An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and… CVSS 3.0CRITICAL 9.8
  • TI-2012-05329 An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango… CVSS 3.1CRITICAL 9.8
  • TI-2002-00609 Polycom ViewStation before 7.2.4 has a default null password for the administrator… CVSS 2.0HIGH 10.0
  • TI-2021-18149 Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by… CVSS 3.1HIGH 8.8
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences