CVE-2025-14432
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-18
Assigner: HP Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hp | poly_videoos | to 4.6.1-444242 (exc) |
| hp | poly_eagleeye_cube | * |
| hp | poly_eagleeye_iv | * |
| hp | poly_studio_a2 | * |
| hp | poly_studio_e60 | * |
| hp | poly_studio_e70 | * |
| hp | poly_studio_g62 | * |
| hp | poly_studio_g7500 | * |
| hp | poly_studio_usb | * |
| hp | poly_studio_x30 | * |
| hp | poly_studio_x32 | * |
| hp | poly_studio_x50 | * |
| hp | poly_studio_x52 | * |
| hp | poly_studio_x70 | * |
| hp | poly_studio_x72 | * |
| hp | poly_tcos | to 6.6.1-7001859 (exc) |
| hp | poly_tc10 | * |
| hp | poly_tc8 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Microsoft Teams Admin Center (TAC) where, in limited scenarios, sensitive data might be written to a log file when an admin makes device configuration changes. The log file is only accessible to users with admin credentials. This issue is specific to TAC and does not affect configuration changes made through the provisioning server or the device WebUI.
How can this vulnerability impact me? :
The vulnerability could lead to exposure of sensitive data in log files accessible to users with admin credentials. If an attacker or unauthorized admin accesses these logs, they might obtain sensitive information, potentially leading to data leakage or misuse within the administrative environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid making device configuration changes using the Microsoft Teams Admin Center (TAC) until a fix is available. Instead, use the provisioning server or the device WebUI for configuration changes, as these methods are not affected by the vulnerability.