CVE-2025-34093

Deeper analysis

An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known.

Attackers who can reach the Telnet service and satisfy any required authentication can supply malicious input to the traceroute command, resulting in arbitrary command execution as root. The vulnerability is tracked as CWE-78 with a CVSS 4.0 score of 7.5 reflecting network-accessible attack vectors and high impact on confidentiality, integrity, and availability.

Public exploit code for the issue has been available for years, including a Metasploit module and entries on Exploit-DB, along with prior technical analyses and an archived Polycom security advisory describing a hotfix release. The associated EPSS score has remained flat at its peak value of 0.7210 with no material increase after disclosure.