Polycom - vulnerabilities (CVEs)

40 CVEs in 133 products, 0 in the last 30 days, newest from 2025-07-10.

Products

• Realpresence Resource Manager - 5 CVEs
• Viewstation 128 - 5 CVEs
• Viewstation 512 - 5 CVEs
• Viewstation Dcp - 5 CVEs
• Viewstation Fx Vs4000 - 5 CVEs
• Viewstation H.323 - 5 CVEs
• Viewstation Mp - 5 CVEs
• Viewstation Sp 384 - 5 CVEs
• Viewstation V.35 - 5 CVEs
• Unified Communications Software - 4 CVEs
• Hdx System Software - 3 CVEs
• Better Together Over Ethernet Connector - 2 CVEs
• Hdx - 2 CVEs
• Hdx Video End Points - 2 CVEs
• Qdx 6000 Firmware - 2 CVEs
• Realpresence Debut Firmware - 2 CVEs
• Trio 8500 Firmware - 2 CVEs
• Uc Apl - 2 CVEs
• Viavideo - 2 CVEs
• Vvx 500 Firmware - 2 CVEs
• Vvx 601 Firmware - 2 CVEs
• Btoe Connector - 1 CVEs
• Group Series - 1 CVEs
• Mgc-100 - 1 CVEs
• Mgc-25 - 1 CVEs
• Mgc-50 - 1 CVEs
• Obihai Obi1022 Firmware - 1 CVEs
• Pano - 1 CVEs
• Realpresence Cloudaxis Suite - 1 CVEs
• Realpresence Web Suite - 1 CVEs
• Soundpoint Ip 301 - 1 CVEs
• Soundpoint Ip 601 - 1 CVEs
• Soundpoint Ip 650 - 1 CVEs
• United Communications Software - 1 CVEs
• Vvx 400 Firmware - 1 CVEs
• Vvx 410 Firmware - 1 CVEs
• C12 - 0 CVEs
• C16 - 0 CVEs
• C8 - 0 CVEs
• Cma System Software - 0 CVEs
• Converged Management Application 4000 - 0 CVEs
• Converged Management Application 5000 - 0 CVEs
• Datastore - 0 CVEs
• Distributed Media Application 7000 - 0 CVEs
• Dma System Software - 0 CVEs
• Global Management System - 0 CVEs
• Hdx 4002 - 0 CVEs
• Hdx 4500 - 0 CVEs
• Hdx 6000 - 0 CVEs
• Hdx 7001 - 0 CVEs
• Hdx 7002 - 0 CVEs
• Hdx 8000 - 0 CVEs
• Hdx 8002 - 0 CVEs
• Hdx 8004 - 0 CVEs
• Hdx 8006 - 0 CVEs
• Hdx 9002 - 0 CVEs
• Hdx 9004 - 0 CVEs
• Hdx 9006 - 0 CVEs
• Mgc Manager - 0 CVEs
• Obihai Obi1022 - 0 CVEs
• Pathnavigator - 0 CVEs
• Qdx 6000 - 0 CVEs
• Realpresence Capture Station Software - 0 CVEs
• Realpresence Debut - 0 CVEs
• Realpresence Media Manager Software - 0 CVEs
• Realpresence Presenterpro Software - 0 CVEs
• Realpresence Trio - 0 CVEs
• Recording And Streaming Server 4000 - 0 CVEs
• Rmx 1500 - 0 CVEs
• Rmx 2000 - 0 CVEs
• Rmx 4000 - 0 CVEs
• Rmx System Software - 0 CVEs
• Rss System Software - 0 CVEs
• S4gw System Software - 0 CVEs
• Serial Gateway S4gw - 0 CVEs
• Soundpoint Ip 300 - 0 CVEs
• Soundpoint Ip 320 - 0 CVEs
• Soundpoint Ip 321 - 0 CVEs
• Soundpoint Ip 330 - 0 CVEs
• Soundpoint Ip 331 - 0 CVEs
• Soundpoint Ip 335 - 0 CVEs
• Soundpoint Ip 430 - 0 CVEs
• Soundpoint Ip 450 - 0 CVEs
• Soundpoint Ip 500 - 0 CVEs
• Soundpoint Ip 501 - 0 CVEs
• Soundpoint Ip 550 - 0 CVEs
• Soundpoint Ip 560 - 0 CVEs
• Soundpoint Ip 600 - 0 CVEs
• Soundpoint Ip 670 - 0 CVEs
• Soundpoint Pro Se-220 - 0 CVEs
• Soundpoint Pro Se-225 - 0 CVEs
• Soundstation2 - 0 CVEs
• Soundstation2 Avaya 2490 - 0 CVEs
• Soundstation2 Direct Connect For Nortel - 0 CVEs
• Soundstation2w - 0 CVEs
• Soundstation Duo - 0 CVEs
• Soundstation Ip - 0 CVEs
• Soundstation Ip 4000 - 0 CVEs
• Soundstation Ip 5000 - 0 CVEs
• Soundstation Ip 6000 - 0 CVEs
• Soundstation Ip 7000 - 0 CVEs
• Soundstation Ip 7000 Video Integration - 0 CVEs
• Soundstation Vtx 1000 - 0 CVEs
• Trio 8500 - 0 CVEs
• Trio 8800 - 0 CVEs
• Tts - 0 CVEs
• Viewstation Fx Vs 4000 - 0 CVEs
• Viewstation Sp Sp384 - 0 CVEs
• Vvx - 0 CVEs
• Vvx150 - 0 CVEs
• Vvx201 - 0 CVEs
• Vvx250 - 0 CVEs
• Vvx300 - 0 CVEs
• Vvx301 - 0 CVEs
• Vvx310 - 0 CVEs
• Vvx311 - 0 CVEs
• Vvx350 - 0 CVEs
• Vvx400 - 0 CVEs
• Vvx401 - 0 CVEs
• Vvx410 - 0 CVEs
• Vvx411 - 0 CVEs
• Vvx450 - 0 CVEs
• Vvx500 - 0 CVEs
• Vvx501 - 0 CVEs
• Vvx600 - 0 CVEs
• Vvx601 - 0 CVEs
• Vvx 400 - 0 CVEs
• Vvx 401 - 0 CVEs
• Vvx 410 - 0 CVEs
• Vvx 411 - 0 CVEs
• Vvx 500 - 0 CVEs
• Vvx 501 Firmware - 0 CVEs
• Vvx 601 - 0 CVEs

Newest CVEs of Polycom

• CVE-2025-34093 - CVSS 7.5 (high), 2025-07-10: An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command…
• CVE-2021-41322 - CVSS 8.8 (high), 2021-10-04: Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process.
• CVE-2019-11355 - CVSS 7.2 (high), 2020-03-12: An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of…
• CVE-2012-6611 - CVSS 9.8 (critical), 2020-02-10: An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Development Platform…
• CVE-2012-6610 - CVSS 8.8 (high), 2020-01-28: Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ;…
• CVE-2012-6609 - CVSS 7.5 (high), 2020-01-28: Directory traversal vulnerability in a_getlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read…
• CVE-2019-14259 - CVSS 8 (high), 2019-08-01: On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in the NTP server IP address field for the…
• CVE-2019-12948 - CVSS 8.3 (high), 2019-07-29: A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if…
• CVE-2019-10689 - CVSS 6.5 (medium), 2019-06-24: VVX products using UCS software version 5.9.2 and earlier with Better Together over Ethernet Connector (BToE) application version 3.9.1 and earlier provides…
• CVE-2018-10947 - CVSS 3.1 (low), 2019-06-13: An issue was discovered in versions earlier than 1.3.2 for Polycom RealPresence Debut where the admin cookie is reset only after a Debut is rebooted.
• CVE-2018-10946 - CVSS 6.8 (medium), 2019-06-13: An issue was discovered in versions earlier than 1.3.0-66872 for Polycom RealPresence Debut that allows attackers to arbitrarily read the admin user's…
• CVE-2018-15128 - CVSS 9.8 (critical), 2019-05-13: An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability…
• CVE-2019-10688 - CVSS 6.8 (medium), 2019-04-23: VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded…
• CVE-2018-14934 - CVSS 6.5 (medium), 2018-11-15: The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and…
• CVE-2018-14935 - CVSS 6.1 (medium), 2018-11-15: The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.
• CVE-2018-18566 - CVSS 5.3 (medium), 2018-10-24: The SIP service in Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allow remote attackers to obtain sensitive phone configuration information by…
• CVE-2018-18568 - CVSS 5.9 (medium), 2018-10-24: Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to…
• CVE-2018-12592 - CVSS 7.5 (high), 2018-06-20: Polycom RealPresence Web Suite before 2.2.0 does not block a user's video for a few seconds upon joining a meeting (when the user has explicitly chosen to…
• CVE-2018-7565 - CVSS 8.8 (high), 2018-03-07: CSRF exists on Polycom QDX 6000 devices.
• CVE-2018-7564 - CVSS 6.1 (medium), 2018-03-07: Stored XSS exists on Polycom QDX 6000 devices.
• CVE-2015-4683 - CVSS 9.8 (critical), 2017-09-19: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use…
• CVE-2015-4682 - CVSS 6.5 (medium), 2017-09-19: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to…
• CVE-2015-4685 - CVSS 7 (high), 2017-09-19: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in…
• CVE-2015-4681 - CVSS 7.8 (high), 2017-09-19: Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords.
• CVE-2015-4684 - CVSS 6.5 (medium), 2017-09-19: Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read…
• CVE-2015-8300 - CVSS 7.8 (high), 2017-08-28: Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe,"…
• CVE-2017-12857 - CVSS 8.8 (high), 2017-08-25: Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a…
• CVE-2015-1516 - CVSS 3.5 (low), 2015-09-03: Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script…
• CVE-2012-4970 - CVSS 4.3 (medium), 2013-01-01: Cross-site scripting (XSS) vulnerability in the web management interface on Polycom HDX Video End Points with UC APL software before 2.7.1.1_J, and commercial…
• CVE-2007-3368 - CVSS 7.8 (high), 2007-06-22: Buffer overflow in the HTTP server on the Polycom SoundPoint IP 601 SIP phone with BootROM 3.0.x+ allows remote attackers to cause a denial of service (device…