What’s Vulnerable › Vulnerabilities

CVE-2022-26479

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-17 · updated 2026-06-17
• Weakness: CWE-863

Description

An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file (which can be created via an rsync backdoor) causes all API calls to execute as admin without authentication.

Affected products

• Poly Eagleeye Director Ii Firmware: before 2.2.2.1 — fixed in 2.2.2.1

How to fix

Upgrade to a fixed version: Poly Eagleeye Director Ii Firmware 2.2.2.1. Check the vendor advisory for mitigations.

References

• https://sec-consult.com/de/vulnerability-lab/advisory/poly-eagleeye-director-ii-kritische-schwachstellen/
• https://sec-consult.com/vulnerability-lab/advisory/critical-vulnerabilities-poly-eagleeye-director-ii/
• https://www.poly.com/us/en/support/security-center
• https://sec-consult.com/de/vulnerability-lab/advisory/poly-eagleeye-director-ii-kritische-schwachstellen/
• https://sec-consult.com/vulnerability-lab/advisory/critical-vulnerabilities-poly-eagleeye-director-ii/
• https://www.poly.com/us/en/support/security-center

Get alerted when CVE-2022-26479 or the next vulnerability affects your stack