CVE-2015-8300

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-275

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/134523/Polycom-BTOE-Connector-2.3.0-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Nov/88Mailing List, Third Party Advisory
https://github.com/sbaresearch/advisories/tree/public/2015/Polycom_20150513
http://packetstormsecurity.com/files/134523/Polycom-BTOE-Connector-2.3.0-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Nov/88Mailing List, Third Party Advisory
https://github.com/sbaresearch/advisories/tree/public/2015/Polycom_20150513

Timeline

Published: Aug 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-83034.0Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, wh CVE-2015-83047.8Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted ap CVE-2015-83055.5Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted CVE-2015-83067.8Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-C CVE-2015-83077.8The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before CVE-2015-83087.8LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.CVE-2015-83094.3Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" pa CVE-2015-83105.4Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or H CVE-2015-83127.8Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system CVE-2015-83135.9GnuTLS incorrectly validates the first byte of padding in CBC modes CVE-2015-83147.5The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persis CVE-2015-83157.5The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "re