The vulnerability involves a command injection in a USB‑accessible management API on HP Poly EagleEye Cube USB devices. The API fails to validate input properly, allowing an attacker without administrator privileges to inject arbitrary commands into the CSR certificate generation routine. Exploitation grants root access, enabling full control over the device, data exfiltration, and the installation of a persistent backdoor that could communicate over Ethernet.

Affects HP Poly EagleEye Cube USB 1.3.1-001267 devices; the vulnerability specifically targets the USB management service exposed on this model and version. No other vendors or product lines are listed.

The exploit requires physical USB access to the management port and knowledge of the vulnerable API call. The EPSS score is unavailable and the vulnerability is not listed in KEV, but the ability to achieve root provides a high severity level. Attackers could use the backdoor to remain hidden on the local network. Because the exploit does not require privileged USB users, the likelihood is high in environments where USB management ports are accessible. The risk remains tall due to lack of public patch information.