CVE-2018-17875

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated users to execute commands via unspecified vectors.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://unkl4b.github.io/Authenticated-RCE-in-Polycom-Trio-8800-pt-1/Exploit, Third Party Advisory
https://support.polycom.com/content/support/emea/emea/en/support/voice/polycom-trio/polycom-trio-8800.htmlProduct, Third Party Advisory
http://unkl4b.github.io/Authenticated-RCE-in-Polycom-Trio-8800-pt-1/Exploit, Third Party Advisory
https://support.polycom.com/content/support/emea/emea/en/support/voice/polycom-trio/polycom-trio-8800.htmlProduct, Third Party Advisory

Timeline

Published: Dec 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-178766.1A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.CVE-2018-178777.5A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an exter CVE-2018-178789.8Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprint CVE-2018-178799.8An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are CVE-2018-17884.4IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force I CVE-2018-178807.5On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot CVE-2018-178819.8On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger CVE-2018-178827.5An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Et CVE-2018-178836.1An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious CVE-2018-178846.1XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-ad CVE-2018-178865.4An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, a CVE-2018-178889.8NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active