github - ghsa-jr38-4278-53pj

GHSA-JR38-4278-53PJ

Vulnerability from github – Published: 2025-12-16 18:31 – Updated: 2025-12-18 21:31

Details

In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.

Severity ?

4.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

8.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-14432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T16:15:57Z",
    "severity": "HIGH"
  },
  "details": "In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.",
  "id": "GHSA-jr38-4278-53pj",
  "modified": "2025-12-18T21:31:34Z",
  "published": "2025-12-16T18:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14432"
    },
    {
      "type": "WEB",
      "url": "https://support.hp.com/us-en/document/ish_13612310-13612332-16/hpsbpy04080"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-14432 (GCVE-0-2025-14432)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:15 – Updated: 2025-12-17 18:48

Title

Poly Video - Sensitive Data Might Be Written to Log File

Summary

Severity ?

8.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

References

URL

Tags

https://support.hp.com/us-en/document/ish_1361231…

Impacted products

Vendor

Product

Version

HP Inc

Poly G7500

Affected: 0 , < <PolyOS 4.6.1-444242 (custom)

HP Inc	Poly Studio G62	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio X72	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio X52	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio X32	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio X70	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio X50	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio X30	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio E70	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio E60	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly EagleEye Cube	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Polycom EagleEye IV	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio A2	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	Poly Studio USB	Affected: 0 , < <PolyOS 4.6.1-444242 (custom)
HP Inc	TC8	Affected: 0 , < <TCOS 6.6.1-7001859 (custom)
HP Inc	TC10	Affected: 0 , < <TCOS 6.6.1-7001859 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14432",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T15:21:46.269401Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T18:48:49.155Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Poly G7500",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio G62",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio X72",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio X52",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio X32",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio X70",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio X50",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio X30",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio E70",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio E60",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly EagleEye Cube",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Polycom EagleEye IV",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio A2",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Poly Studio USB",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cPolyOS 4.6.1-444242",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC8",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cTCOS 6.6.1-7001859",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC10",
          "vendor": "HP Inc",
          "versions": [
            {
              "lessThan": "\u003cTCOS 6.6.1-7001859",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.\u003c/span\u003e"
            }
          ],
          "value": "In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T15:15:04.611Z",
        "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
        "shortName": "hp"
      },
      "references": [
        {
          "url": "https://support.hp.com/us-en/document/ish_13612310-13612332-16/hpsbpy04080"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Poly Video - Sensitive Data Might Be Written to Log File",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
    "assignerShortName": "hp",
    "cveId": "CVE-2025-14432",
    "datePublished": "2025-12-16T15:15:04.611Z",
    "dateReserved": "2025-12-10T04:26:10.936Z",
    "dateUpdated": "2025-12-17T18:48:49.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-JR38-4278-53PJ

CVE-2025-14432 (GCVE-0-2025-14432)

Tags

Sightings

Nomenclature