CVE-2026-39430
Received Received - Intake

Unauthenticated Admin Access in HP Poly EagleEye Cube USB

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: MITRE

Description
On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings (without logging in) via a modified client that bypasses the login step or via a custom client to make the underlying administrator API calls. This allows unauthenticated users to perform administrative actions too such as exporting configuration files that include the internal device credentials for the administrator user and other network systems.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-39430
EUVD
EUVD-2026-116925

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects HP Poly EagleEye Cube USB devices running version 1.3.1-001267. The issue is in the administrator authentication system, where session management and access controls are not properly enforced. As a result, an attacker can bypass login requirements and perform administrative actions without authentication. This includes changing settings or exporting configuration files that contain sensitive credentials for the admin account and other network systems.

Detection Guidance

To detect this vulnerability, check if HP Poly EagleEye Cube USB devices are running version 1.3.1-001267. Inspect network traffic for unauthorized administrative API calls or modified client interactions. Monitor for unexpected configuration file exports or credential exposure.

Impact Analysis

If you use an affected HP Poly EagleEye Cube USB device, an attacker could gain unauthorized access to administrative functions. This might allow them to alter device settings, steal sensitive configuration data including credentials, or compromise connected network systems. The impact includes potential data breaches, loss of control over the device, and exposure of internal network credentials.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA. Exposure of internal device credentials and configuration files may result in unauthorized access to sensitive data, violating confidentiality requirements. Organizations could face legal penalties, fines, or reputational damage due to compromised personal or health information.

Mitigation Strategies

Immediately isolate affected HP Poly EagleEye Cube USB devices from your network to prevent unauthorized access. Disable or restrict network access to the device until a patch is applied. Review and rotate all credentials stored in the device configuration files, including administrator and network system credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...