{"id":"CVE-2019-11355","aliases":["EUVD-2019-3034","GHSA-wjqc-hf5j-wc82"],"status":"published","title":"An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the...","description":"An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01081,"percentile":0.65374,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2020-03-12T20:56:02Z","modified":"2026-06-17T02:12:45Z","products":[{"vendor":"polycom","product":"hdx_system_software"}],"references":[{"url":"https://support.polycom.com/content/dam/polycom-support/global/documentation/hdx-3-1-14-advisory.pdf","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11355"},{"url":"https://github.com/advisories/GHSA-wjqc-hf5j-wc82"}],"sources":{"cve":[{"id":"CVE-2019-11355","description":"An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root.","status":"published","published":"2020-03-12T20:56:02Z","modified":"2024-08-04T22:48:09.174Z","updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-3034","description":"An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root.","status":"published","published":"2020-03-12T20:56:02Z","modified":"2024-08-04T22:48:09Z","updated_at":"2026-11-03T02:40:49.362838Z"}],"ghsa":[{"id":"GHSA-wjqc-hf5j-wc82","title":"An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the...","description":"An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root.","status":"published","published":"2022-05-24T17:10:48Z","modified":"2023-01-29T05:01:45Z","updated_at":"2026-11-02T14:44:54.429174Z"}],"nvd":[{"id":"CVE-2019-11355","description":"An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root.","status":"published","published":"2020-03-12T21:15:12.78Z","modified":"2026-06-17T02:12:45.76Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:45.254119Z"}]}}