What’s Vulnerable › Vulnerabilities
CVE-2025-14432: Poly Video - Sensitive Data Might Be Written to Log File
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-16 · updated 2026-10-07
- Weakness: CWE-532
Description
In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.
Affected products
- HP Poly Tcos: before 6.6.1-7001859 — fixed in 6.6.1-7001859
- HP Poly Videoos: before 4.6.1-444242 — fixed in 4.6.1-444242
How to fix
Upgrade to a fixed version: HP Poly Tcos 6.6.1-7001859; HP Poly Videoos 4.6.1-444242. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-14432 or the next vulnerability affects your stack