# CVE-2026-39431: HP Poly EagleEye Cube USB command injection via API

Source: https://junglewise.ai/threats/cve-2026-39431-on-hp-poly-eagleeye-cube-usb-1-3-1-001267-devices-one-of-the-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-39431 · Severity: info · Published 2026-11-04

HP Poly EagleEye Cube USB is a video conferencing camera accessory for enterprise meetings. A vulnerability in its management API allows attackers to inject arbitrary commands through the certificate generation process, gaining root-level control of the device. This enables attackers to intercept video/audio, exfiltrate data, or establish persistent backdoors on corporate networks.

Vendors: [Hp](https://junglewise.ai/threats/vendors/hp).

## Quick answers

**Is CVE-2026-39431 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39431 being exploited in the wild.

**How severe is CVE-2026-39431?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Hp Poly EagleEye Cube USB 1.3.1-001267.

**Is there a fix for CVE-2026-39431?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-39431 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-39431?** Check whether you run Hp Poly EagleEye Cube USB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in an API function on the USB-accessible management service due to insufficient input validation in the CSR certificate generation process. An unauthenticated attacker can exploit this via USB to execute arbitrary commands as root without administrator credentials. The vulnerability provides complete device compromise including persistent backdoor installation.

## Affected products

- HP Poly EagleEye Cube USB 1.3.1-001267

## Timeline

- 2026-11-04: disclosed

## References

- [https://docs.poly.com/bundle/eagleeye-cube-usb-ug-1-3-0/page/t2821658.html](https://docs.poly.com/bundle/eagleeye-cube-usb-ug-1-3-0/page/t2821658.html)
- [https://github.com/thackeraaron/polycom_research/blob/main/CVE-2026-39430_and_CVE-2026-39431.md](https://github.com/thackeraaron/polycom_research/blob/main/CVE-2026-39430_and_CVE-2026-39431.md)

## Related threats

- [HP Poly EagleEye Cube USB authentication bypass in administrator session management](https://junglewise.ai/threats/cve-2026-39430-on-hp-poly-eagleeye-cube-usb-1-3-1-001267-devices-the)