CVE-2023-4467
Poly Trio 8800 Firmware 7.2.6.0019
Raw vector
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-4467 is a medium-severity Hidden Functionality (CWE-912) vulnerability in Poly Trio 8800 Firmware. Its CVSS base score is 6.2 (Medium).
Operationally, ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54322
Vulnerability Data
A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on…
more
the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documenting every system component at the required granularity and reviewing the inventory detects or prevents hidden functionality from remaining undetected.
Recovery eliminates hidden functionality or backdoors introduced during compromise.
Policy requires supplier transparency and testing to detect hidden functionality or backdoors inserted in the supply chain.
Screening high-risk technical positions lowers the probability that hidden functionality or backdoors will be added by authorized personnel.
Hunting identifies hidden functionality used for persistence or evasion after initial compromise.
TSCM surveys discover and eliminate hidden surveillance functionality that would otherwise remain undetected in the environment.
Change control, approval gates, and flaw tracking force hidden functionality to be either documented or discovered and removed.
Vetting and integrity controls during acquisition reduce the likelihood of hidden backdoors or malicious functionality introduced by suppliers.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Monitoring activities can detect anomalous behavior from hidden functions but do not eliminate the weakness.
Secure development life cycle mandates documented requirements and design reviews that would expose undocumented hidden functionality.
A.8.26 only requires that security requirements (including resilience against attacks such as SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent the presence of hidden/backdoor functionality that violates those requirements.
Secure system architecture and engineering principles require transparent, documented designs that preclude hidden functionality.
Secure coding standards reduce the likelihood of introducing hidden code but do not address its detection or removal.
Security testing in development and acceptance can discover undocumented functionality before release.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-912, a class-level weakness, and none of its children carries one either.