How severe is CVE-2023-4466?

CVE-2023-4466 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2023-4466 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-4466?

CVE-2023-4466 primarily affects Poly Ccx 400 Firmware. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-4466?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-4466 published?

CVE-2023-4466 was published on 2023-12-29 and last updated on 2026-06-17.

CVE-2023-4466

CVE-2023-4466 is a low-severity vulnerability in Poly Ccx 400 Firmware with a CVSS 3.x base score of 2.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-693.

Key facts

Severity: Low (CVSS 3.x base score 2.7)
CVSS v2: 3.3
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-693
Affected product: Poly Ccx 400 Firmware
Published: 2023-12-29
Last modified: 2026-06-17

Description

A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.

Frequently asked questions

What is CVE-2023-4466?: A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.
How severe is CVE-2023-4466?: CVE-2023-4466 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2023-4466 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-4466?: CVE-2023-4466 primarily affects Poly Ccx 400 Firmware. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-4466?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-4466 published?: CVE-2023-4466 was published on 2023-12-29 and last updated on 2026-06-17.

References

Affected products (4)

cpe:2.3:o:poly:ccx_400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:poly:ccx_600_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:poly:trio_8800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:poly:trio_c60_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Poly Ccx 400 Firmware

CVE-2023-4464 — High (CVSS 7.2): A vulnerability, which was classified as critical, has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60,…
CVE-2023-4463 — Medium (CVSS 5.3): A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This…
CVE-2023-4462 — Low (CVSS 3.7): A vulnerability classified as problematic has been found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350,…
CVE-2023-4465 — Low (CVSS 2.7): A vulnerability, which was classified as problematic, was found in Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX…

All CVEs affecting Poly Ccx 400 Firmware →

Other CWE-693 (Protection Mechanism Failure) vulnerabilities

CVE-2026-47140 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins…
CVE-2026-34208 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects…
CVE-2026-34938 — Critical (CVSS 10.0): PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs…
CVE-2026-2761 — Critical (CVSS 10.0): Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33,…
CVE-2022-32845 — Critical (CVSS 10.0): This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS…
CVE-2026-45102 — Critical (CVSS 9.9): OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm…

Browse all CWE-693 (Protection Mechanism Failure) vulnerabilities →