The vulnerability in HP Poly EagleEye Cube USB firmware 1.3.1-001267 allows an unauthenticated user to bypass the administrator authentication flow. Session management and device‑side access controls are not enforced, so a crafted client can skip the login procedure and call the underlying administrator API endpoints. This enables the attacker to perform any privileged task, such as exporting configuration files that contain internal credentials for the administrator user and connected network systems.

HP Poly EagleEye Cube USB 1.3.1-001267 devices are affected. No vendor or product list beyond the device model and firmware version is available.

The flaw represents a severe authentication bypass that can be exploited by any user with network access to the device, without requiring valid credentials or initial login. The absence of EPSS data and non‑listing in the CISA KEV catalog does not mitigate the inherent risk; the impact is that attackers could obtain confidential credentials and modify network configurations. Exploitation requires a custom client or modified user agent capable of sending the privileged API calls that normally would be protected by authentication.