HP Poly Products Sensitive Data Logging Vulnerability in Microsoft Teams Admin Center

A vulnerability exists in certain HP Poly products that can lead to the unintentional logging of sensitive data. This issue arises when an administrator makes device configuration changes through the Microsoft Teams Admin Center (TAC). The logged data is only accessible to users with admin rights. Notably, this vulnerability is exclusive to Microsoft TAC and does not impact changes made via the provisioning server or the device's WebUI.

Impact

According to HP, this vulnerability has a high severity rating and can lead to unauthorized information disclosure.

Remediation

HP advises that device configuration changes be made using the provisioning server or the device WebUI, rather than the Microsoft Teams Admin Center, until the devices can be updated to the latest PolyOS version via Poly Lens. Instructions for using Poly Lens are available on the HP website.