CVE-2023-4465

Name: CVE-2023-4465
Creator: NVD / NIST
Published: 2023-12-29T10:15:12.133+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 0.46%

Last modified Jun 17, 2026

CVE-2023-4465 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. Affected is an unknown function of the component Configuration File Import. EPSS estimates a 0.46% chance of exploitation in the next 30 days.

Description

A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

0.46%

36.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-620

Affected Software

Vendor	Product	Versions
Poly	Ccx 400 Firmware	All versions
Poly	Ccx 600 Firmware	All versions
Poly	Trio 8800 Firmware	All versions
Poly	Trio C60 Firmware	All versions

References

https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.htmlNot Applicable
https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices
https://modzero.com/en/advisories/mz-23-01-poly-voip/
https://support.hp.com/us-en/document/ish_9929371-9929407-16/hpsbpy03899
https://vuldb.com/?ctiid.249258Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.249258Third Party Advisory, VDB Entry
https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11919.htmlNot Applicable
https://github.com/modzero/MZ-23-01-Poly-VoIP-Devices
https://modzero.com/en/advisories/mz-23-01-poly-voip/
https://support.hp.com/us-en/document/ish_9929371-9929407-16/hpsbpy03899
https://vuldb.com/?ctiid.249258Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.249258Third Party Advisory, VDB Entry

Timeline

Published: Dec 29, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-4465?

How severe is CVE-2023-4465?

CVE-2023-4465 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.46% probability of exploitation in the next 30 days.

How do I fix CVE-2023-4465?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-4465?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST