How severe is CVE-2025-43491?

CVE-2025-43491 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-43491 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-43491?

CVE-2025-43491 affects Hp Poly Lens Desktop. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-43491?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-43491 have an EU (EUVD) identifier?

Yes. CVE-2025-43491 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-27626.

When was CVE-2025-43491 published?

CVE-2025-43491 was published on 2025-09-09 and last updated on 2026-06-17.

CVE-2025-43491

CVE-2025-43491 is a critical-severity vulnerability in Hp Poly Lens Desktop with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-99.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 7.3
EPSS exploit prediction: 0% (18th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-27626
Weakness: CWE-99
Affected product: Hp Poly Lens Desktop
Published: 2025-09-09
Last modified: 2026-06-17

Description

A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.

Frequently asked questions

What is CVE-2025-43491?: A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.
How severe is CVE-2025-43491?: CVE-2025-43491 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-43491 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-43491?: CVE-2025-43491 affects Hp Poly Lens Desktop. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-43491?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-43491 have an EU (EUVD) identifier?: Yes. CVE-2025-43491 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-27626.
When was CVE-2025-43491 published?: CVE-2025-43491 was published on 2025-09-09 and last updated on 2026-06-17.

References

https://support.hp.com/us-en/document/ish_12979589-12979615-16/hpsbpy04048

Affected products (1)

cpe:2.3:a:hp:poly_lens_desktop:*:*:*:*:*:*:*:*

Other CWE-99 vulnerabilities

CVE-2017-5159 — Critical (CVSS 9.8): An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an…
CVE-2025-2410 — Critical (CVSS 9.1): Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if…
CVE-2025-0756 — Critical (CVSS 9.1): Overview The product receives input from an upstream component, but it does not restrict or incorrectly…
CVE-2024-57971 — Critical (CVSS 9.1): DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that…
CVE-2024-5706 — High (CVSS 8.8): The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input…
CVE-2023-3517 — High (CVSS 8.5): Hitachi Vantara Pentaho Data Integration & Analytics versions before 9.5.0.1 and 9.3.0.5, including 8.3.x does not…

Browse all CWE-99 vulnerabilities →