CVE-2022-26479
Critical
Description
An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file (which can be created via an rsync backdoor) causes all API calls to execute as admin without authentication.
SeverityCritical
CVSS9.8
Exploit probability—
ProductPoly Eagleeye Director Ii Firmware
PublishedJul 17, 2022
First seenJul 17, 2022
How to fix
Update
- poly eagleeye_director_ii_firmware2.2.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| poly eagleeye_director_ii_firmware | v < 2.2.2.1 | 2.2.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.