CVE-2026-39431

Quick assessment

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 HP Poly EagleEye Cube USB 1.3.1-001267 设备上，其可通过 USB 接口访问的管理服务中，其中一个 API 函数存在命令注入漏洞。该漏洞使得攻击者（无需管理员权限）能够以 root 身份在设备上执行任意命令。问题根源在于输入验证不足，导致攻击者能够干预 CSR（证书签名请求）证书生成的部分流程。由此可获得完整的 root 权限，从而实现对设备运行的全面控制、未经授权的数据访问，以及在该设备上植入持久性后门（该后门可通过以太网端口运行）。

AI Predicted 9.8 Difficulty: Easy Updated Nov 04, 2026

Possible ATT&CK Techniques 3 AI

T1055 · Process Injection T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Updated Nov 04, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service accessible via USB allows command injection. This allows attackers (without administrator-level access) to execute arbitrary commands on the device as root. This is due to insufficient input validation that allows an attacker to control part of the CSR certificate generation process. This provides full root access that permits full control over device operations, unauthorized access to data, and the ability to place a persistent backdoor on the device (which could operate via the Ethernet port).

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	n/a	n/a	-

II. Public POCs for CVE-2026-39431

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-39431

请登录查看更多情报信息。

Other References for CVE-2026-39431 (3)

https://www.cve.org/CVERecord?id=CVE-2026-39431

Same Patch Batch · n/a · 2026-11-04 · 3 CVEs total

CVE-2026-121610	7.3 HIGH	funadmin Frontend List Endpoint index selectList sql injection
CVE-2026-39430		HP Poly EagleEye Cube 1.3.1 认证绕过漏洞

IV. Related Vulnerabilities

Same product: n/a

Same vendor: n/a