CVE-2023-4464
📋 TL;DR
This critical vulnerability in Poly VoIP devices allows remote attackers to execute arbitrary operating system commands via the Diagnostic Telnet Mode component. It affects numerous Poly Trio, CCX, EDGE, and VVX models, potentially compromising the entire device. Attackers can exploit this without authentication to gain full control.
💻 Affected Systems
- Poly Trio 8300
- Trio 8500
- Trio 8800
- Trio C60
- CCX 350
- CCX 400
- CCX 500
- CCX 505
- CCX 600
- CCX 700
- EDGE E100
- EDGE E220
- EDGE E300
- EDGE E320
- EDGE E350
- EDGE E400
- EDGE E450
- EDGE E500
- EDGE E550
- VVX 101
- VVX 150
- VVX 201
- VVX 250
- VVX 300
- VVX 301
- VVX 310
- VVX 311
- VVX 350
- VVX 400
- VVX 401
- VVX 410
- VVX 411
- VVX 450
- VVX 500
- VVX 501
- VVX 600
- VVX 601
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to install persistent malware, pivot to internal networks, exfiltrate sensitive data, or render devices unusable.
Likely Case
Remote code execution leading to device takeover, credential theft, and use as a foothold for lateral movement within the network.
If Mitigated
Limited impact if devices are isolated in separate VLANs with strict network segmentation and access controls.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to HP/Poly advisory HPSBPY03898 for specific firmware versions
Vendor Advisory: https://support.hp.com/us-en/document/ish_9931565-9931594-16/hpsbpy03898
Restart Required: Yes
Instructions:
1. Identify affected devices using version check. 2. Download latest firmware from HP/Poly support portal. 3. Apply firmware update following vendor instructions. 4. Verify update completed successfully. 5. Restart devices as required.
🔧 Temporary Workarounds
Disable Diagnostic Telnet Mode
allDisable the vulnerable Diagnostic Telnet Mode feature if not required for operations.
Access device admin interface > Security settings > Disable Diagnostic Telnet Mode
Network Access Control
linuxRestrict network access to Poly devices using firewall rules or network segmentation.
iptables -A INPUT -p tcp --dport 23 -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="23" protocol="tcp" accept'
🧯 If You Can't Patch
- Isolate affected devices in separate VLAN with strict firewall rules blocking all unnecessary inbound traffic.
- Implement network monitoring and intrusion detection specifically for Telnet traffic to Poly devices.
🔍 How to Verify
Check if Vulnerable:
Check if Diagnostic Telnet Mode is enabled on port 23 and test with public exploit scripts from GitHub repository.Check Version:
Access device web interface > System Information > Firmware Version or use SSH/Telnet to check versionVerify Fix Applied:
Verify firmware version matches patched versions in vendor advisory and test that Diagnostic Telnet Mode no longer accepts command injection.📡 Detection & Monitoring
Log Indicators:
- Unusual Telnet connections to device port 23
- Suspicious command execution in system logs
- Failed authentication attempts followed by command execution
Network Indicators:
- Telnet traffic to Poly devices from unexpected sources
- Unusual outbound connections from Poly devices
SIEM Query:
source="poly_device" AND (port=23 OR protocol="telnet") AND (command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*)")🔗 References
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
- https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices
- https://modzero.com/en/advisories/mz-23-01-poly-voip/
- https://support.hp.com/us-en/document/ish_9931565-9931594-16/hpsbpy03898
- https://vuldb.com/?ctiid.249257
- https://vuldb.com/?id.249257
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.html
- https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices
- https://modzero.com/en/advisories/mz-23-01-poly-voip/
- https://support.hp.com/us-en/document/ish_9931565-9931594-16/hpsbpy03898
- https://vuldb.com/?ctiid.249257
- https://vuldb.com/?id.249257
