CVE-2023-24282

MediumCVSS 5.4

Published: 08/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

An arbitrary file upload vulnerability in Poly Trio 8800 version 7.2.2.1094 allows attackers to upload arbitrary files via a crafted ringtone file. This can lead to remote code execution on the device.

Risk Assessment

An attacker could gain full control of the Poly Trio 8800 device, potentially leading to eavesdropping, communication disruption, or further attacks on the internal network.

Recommendation

Immediately update the Poly Trio 8800 firmware to the latest available version. Restrict ringtone file uploads to trusted sources only.

Original NVD description (English source)

An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a crafted ringtone file.