Command Injection Vulnerability in HP Poly EagleEye Cube USB Devices
CVE-2026-39431
Currently unrated
What is CVE-2026-39431?
A vulnerability exists in HP Poly EagleEye Cube USB 1.3.1-001267 devices where an API function within a management service accessible via USB is susceptible to command injection. This flaw arises from insufficient input validation, allowing attackers without administrator privileges to execute arbitrary commands as root. As a result, attackers can gain full control over the device, leading to unauthorized access to data and the potential to establish a persistent backdoor, enabling further exploitation through the Ethernet interface.