CVE-2024-3281: HP Poly Ccx 350 authentication bypass (CVSS 8.8)

Description

A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor.

CVSS 3.1 breakdown

Attack vectorAdjacent

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityHigh

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Affected products

HP Poly Ccx 350≥ 8.0.2.3267 < 8.1.3.1301

HP Poly Ccx 400≥ 8.0.2.3267 < 8.1.3.1301

HP Poly Ccx 500≥ 8.0.2.3267 < 8.1.3.1301

HP Poly Ccx 505≥ 8.0.2.3267 < 8.1.1301

HP Poly Ccx 600≥ 8.0.2.3267 < 8.1.3.1301

HP Poly Ccx 700≥ 8.0.2.3267 < 8.1.3.1301

Remediation

Fixed in

HP Poly Ccx 350≥ 8.1.3.1301

HP Poly Ccx 400≥ 8.1.3.1301

HP Poly Ccx 500≥ 8.1.3.1301

HP Poly Ccx 505≥ 8.1.1301

HP Poly Ccx 600≥ 8.1.3.1301

HP Poly Ccx 700≥ 8.1.3.1301

Patch & vendor advisories

https://support.hp.com/us-en/document/ish_10388650-10388701-16/hpsbpy03929

References

https://support.hp.com/us-en/document/ish_10388650-10388701-16/hpsbpy03929Vendor Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-003.txtExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-3281 being actively exploited?

CVE-2024-3281 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.50%.

How severe is CVE-2024-3281?

CVE-2024-3281 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 0.50% probability of exploitation.

Which products are affected by CVE-2024-3281?

Affected products include HP Poly Ccx 350, HP Poly Ccx 400, HP Poly Ccx 500, HP Poly Ccx 505, HP Poly Ccx 600, and 1 more.

How do I fix CVE-2024-3281?

Upgrade affected software to a fixed version, for example HP Poly Ccx 350 8.1.3.1301, HP Poly Ccx 400 8.1.3.1301, HP Poly Ccx 500 8.1.3.1301 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-3281 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo