Two security flaws in the HP Poly EagleEye Cube USB camera allow an attacker to take over the device without ever logging in, according to vulnerability records published on 4 November and examined in a report on 7 November. The more serious of the two carries the highest possible severity score, and neither flaw has a published fix yet.

The camera is a common sight in meeting rooms and video-conferencing setups, where it is usually installed once and then forgotten. That is exactly what makes the flaws worrying: the device sits on the office network, is connected to a shared room computer, and, according to the vulnerability record, stores login details that reach beyond the camera itself.

Admin login not enforced

The first flaw, tracked as CVE-2026-39430, is an authentication failure. The camera's administrator login process is broken because the device itself does not enforce session management or access controls. A person with no credentials can change administrator settings using a modified client that skips the login step, or a custom client that calls the administrator functions directly.

That access includes exporting the camera's configuration file. According to the record, that file contains the camera's administrator credentials and credentials for other systems on the network. If the same password is reused elsewhere, or the camera holds a login for another system, one meeting-room camera can become a key to more of the network.

CISA, the US cybersecurity agency, scored CVE-2026-39430 at 9.8 out of 10 under CVSS 3.1, the critical band, with a vector showing it is reachable over a network, easy to exploit, and needs no login and no user action. CISA also marked it as automatable, with total technical impact. The score comes from CISA's own review of the record; HP has not published its own severity score.

Second flaw allows commands as root

The second flaw, CVE-2026-39431, is a command injection problem in a management service reachable over USB. The record says one function does not properly check its input when generating a certificate signing request, which lets an attacker run commands as root, the highest level of control on the device. CISA scored it 7.2, in the high band.

The two descriptions disagree on how much access the second flaw needs. CISA's scoring says high privileges are required, while the researcher's write-up says an attacker without administrator access can run commands as root. If the first flaw means the admin login is not enforced anyway, the privilege bar for the second may be lower in practice, but that chain has not been demonstrated as a tested attack.

Both flaws were tested on firmware version 1.3.1-001267. The records do not say whether earlier or later versions are affected, and they do not say whether other Poly or HP cameras are affected either.

No fix and no known attacks

There is no known exploitation of either flaw. CISA's assessment lists exploitation as "none" for both, although that can change, particularly since the login bypass is rated easy to automate.

There is also no fix to install. Neither CVE record lists a fixed firmware version, a solution or a workaround, and a search of HP's support site on 7 November found no HP security bulletin naming either CVE. Owners should check HP's security bulletin page directly and keep checking it.

Until a fix appears, the protection is in how the camera is connected and managed. Owners should find every EagleEye Cube USB on their premises, confirm its firmware version, and treat 1.3.1-001267 as affected. Cameras that do not need a network cable should have it unplugged; those that do should sit on a separate network segment, away from staff and guest networks. The room computer the camera plugs into should be locked down, with no shared admin accounts and no unapproved software.

Stored credentials matter most. The camera's admin password should be changed, and any other system logins saved in the camera's settings should be changed on those systems themselves. Logs on those systems should be checked for unfamiliar sign-ins since the camera was installed. Rotating the credentials does not fix the authentication bypass itself, but it limits what an attacker can do with an exported configuration file.