CVE-2023-4465

Poly Ccx 400 Firmware

Published

29 December 2023

Modified

21 November 2024

CVSS Score v3.1 2.7

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS Score 0.0046 39th percentile

Risk Priority 26 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-4465 is a low-severity Unverified Password Change (CWE-620) vulnerability in Poly Ccx 400 Firmware. Its CVSS base score is 2.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-54320

Vulnerability Data

A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE…

E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX 300, VVX 301, VVX 310, VVX 311, VVX 350, VVX 400, VVX 401, VVX 410, VVX 411, VVX 450, VVX 500, VVX 501, VVX 600 and VVX 601. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.

CWE(s): CWE-620

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.002 Steganography Command And Control

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

attack.mitre.org →

T1003.002 Security Account Manager Credential Access

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.

attack.mitre.org →

T1003.007 Proc Filesystem Credential Access

Adversaries may gather credentials from the proc filesystem or `/proc`.

attack.mitre.org →

T1003.008 /etc/passwd and /etc/shadow Credential Access

Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1008 Fallback Channels Command And Control

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-4464Same product: Poly Ccx 400

CVE-2023-4463Same product: Poly Ccx 400

CVE-2023-4466Same product: Poly Ccx 400

CVE-2023-4462Same product: Poly Ccx 400

CVE-2023-4468Same product: Poly Trio 8800

CVE-2023-24282Same product: Poly Trio 8800

CVE-2025-71328Shared CWE-620

CVE-2026-27757Shared CWE-620

CVE-2024-8794Shared CWE-620

CVE-2026-92467Shared CWE-620

Affected Assets

poly

ccx 400 firmware

all versions

poly

ccx 600 firmware

all versions

poly

trio 8800 firmware

all versions

poly

trio c60 firmware

all versions

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-01 partial match

blocks

Credential management practices directly enforce re-authentication for password changes.

PR.AA-03 partial match

blocks

Authentication requirements include verifying identity before allowing credential modifications.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.17 Authentication information partial match

degrades

Requires secure management of authentication information, directly addressing the need to verify the original password before allowing a change.

A.6.5 Responsibilities after termination or change of employment partial match

removes

A.8.26 Application security requirements partial match

removes

A.8.27 Secure system architecture and engineering principles partial match

removes

A.8.28 Secure coding partial match

removes

A.8.5 Secure authentication partial match