CVE-2025-14432

MediumCVSS 4.9/10Last modified Oct 7, 2026

Description

In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
HP IncPoly G7500< <PolyOS 4.6.1-444242
HP IncPoly Studio G62< <PolyOS 4.6.1-444242
HP IncPoly Studio X72< <PolyOS 4.6.1-444242
HP IncPoly Studio X52< <PolyOS 4.6.1-444242
HP IncPoly Studio X32< <PolyOS 4.6.1-444242
HP IncPoly Studio X70< <PolyOS 4.6.1-444242
HP IncPoly Studio X50< <PolyOS 4.6.1-444242
HP IncPoly Studio X30< <PolyOS 4.6.1-444242
HP IncPoly Studio E70< <PolyOS 4.6.1-444242
HP IncPoly Studio E60< <PolyOS 4.6.1-444242
HP IncPoly EagleEye Cube< <PolyOS 4.6.1-444242
HP IncPolycom EagleEye IV< <PolyOS 4.6.1-444242
HP IncPoly Studio A2< <PolyOS 4.6.1-444242
HP IncPoly Studio USB< <PolyOS 4.6.1-444242
HP IncTC8< <TCOS 6.6.1-7001859
HP IncTC10< <TCOS 6.6.1-7001859

References

Timeline

Published
Dec 16, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-144345.3The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_CVE-2025-144356.5Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows auCVE-2025-144367.2The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_connection_id’ parameter in all veCVE-2025-144377.5The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.CVE-2025-144386.4The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0CVE-2025-144409.8The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due tCVE-2025-144414.3The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribeCVE-2025-144425.3The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage oCVE-2025-144436.4A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information CVE-2025-144445.3The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment CVE-2025-144456.4The Image Hotspot by DevVN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hotspot_content' custom field meta in CVE-2025-144465.4The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che
CVE-2025-14432: Medium severity, CVSS 4.9 | Vulnix