CVE-2021-37145

HIGH

Poly CX5500 and CX5100 1.3.5 - Authenticated Remote Code Execution via Telnet Command Injection

Title source: llm

Description

A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escalation and Remote Code Execution capability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://support.polycom.com/content/support.html

Vendor Advisory x_refsource_confirm

https://support.polycom.com/content/dam/polycom-support/global/documentation/security-bulletin-cx5100-cx5500-authenticated-v1-0.pdf

Scores

CVSS v3 7.2

EPSS 0.0198

EPSS Percentile 78.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-77

Status published

Products (2)

poly/cx5100_firmware 1.3.5

poly/cx5500_firmware 1.3.5

Published Sep 07, 2021

Tracked Since Feb 18, 2026