External risk intelligence

HP Poly EagleEye Cube USB Authentication Bypass Exposes Administrator Credentials.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-39430

The affected device is a USB-connected video conferencing camera intended for local or room-based connectivity. While it may be networked in some deployments, it is not designed to be a public-facing internet service, and its role as a peripheral typically places it behind internal network controls rather than on the public internet.

Authentication Bypass

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability allows unauthenticated users to alter settings on certain HP Poly cameras, export configuration files containing credentials, and potentially disrupt operations. The primary concern is confirming if these devices are deployed in a way that exposes them to this risk.

Unauthorized access to camera settings.
Protects credentials and internal device information.
Confirm relevance and device exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by interacting with the device over the network. If the attacker can send specially crafted requests to the device, they can bypass the normal login process and directly access administrative functions. This could allow them to change critical settings, export configuration files containing sensitive credentials, and potentially gain further access to the network.

Network access required.
Bypasses administrator login.
Exposes credentials and network access.

Live Threat

Current exploitation, exposure, and threat context

On HP Poly EagleEye Cube USB devices, an unauthenticated user could change administrator settings and export configuration files. These files may contain sensitive internal device credentials for the administrator user and other network systems. This is possible when an attacker can interact with the device through a modified or custom client that bypasses the normal login process.

Device configuration and credentials at risk.
Unauthenticated access via modified clients.
Unauthorized administrative actions and data export.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects HP Poly EagleEye Cube USB devices, impacting administrator authentication and allowing unauthenticated access to sensitive configurations. Teams responsible for managing end-user devices, AV equipment, and network security should prioritize identifying these devices, assessing their exposure, and coordinating remediation. The first practical step is to locate all instances of the affected technology, determine if they are accessible from untrusted networks or contain critical data, and then identify the accountable owner to plan a risk-based response.

Device owners should manage the issue.
Verify device network reachability and data criticality.
Plan remediation based on risk and vendor input.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HP Poly EagleEye Cube USB?

It is a high-definition video conferencing camera designed for small rooms and collaborative spaces. While it connects via USB to a computer, it also functions as a networked peripheral within meeting environments. This networking capability allows for remote management and configuration of device settings, which is the primary interface impacted by this security issue.

What does CVE-2026-39430 mean?

This is an authentication bypass vulnerability categorized as CWE-287 (Improper Authentication). It means the camera fails to verify the identity of someone trying to access its administrative controls. Because the device skips the login check, a person can send commands to change settings or extract configuration files without ever providing a password.

How can an attacker trigger this vulnerability?

The flaw is triggered when someone interacts with the device's administrative API over the network using a custom or modified client. Simply viewing the camera's video feed or using it through standard meeting software does not trigger this bug. An attacker must actively send crafted network requests specifically designed to bypass the absent login verification.

Is my device at risk if it is not on the internet?

Halo Surface Signal notes that while these cameras are typically kept behind internal network controls and are not designed to be public-facing, they still pose a risk if an attacker reaches them from your internal network. Even if the camera is not directly on the public internet, any unauthorized actor who gains a foothold within your local network could exploit this.

How should I respond to this threat?

Begin by creating an inventory of all EagleEye Cube USB units in your environment. Prioritize identifying devices connected to networks where untrusted users might gain access. Once located, consult official HP support resources to track guidance on firmware updates or security configurations that address these authentication failures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.