CVE-2018-14934

Published: Nov 15, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and subsequently record audio from the device microphone.

Affected (1)

Products: Polycom: Trio 8500 Firmware

Polycom

1 product

Trio 8500 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Polycom Trio 8500 Firmware	Before 5.5.4

Running on/with	Platform Versions
Polycom Trio 8500	All versions

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://support.polycom.com/content/dam/polycom-support/global/documentation/bluetooth-authentication-weakness-trio.pdf

Source: cve@mitre.org

Vendor Advisory

https://support.polycom.com/content/dam/polycom-support/global/documentation/bluetooth-authentication-weakness-trio.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.