Poly EagleEye Cube Vulnerability CVE-2026-39430: Critical Login Bypass in the USB Meeting Room Camera, No Fix Listed, and What to Do Now

Two security flaws published on Wednesday, November 4, 2026 affect the HP Poly EagleEye Cube USB, a camera used in meeting rooms and video conferencing setups. The more serious one, CVE-2026-39430, means the camera does not actually enforce its administrator login. Anyone using a modified or custom client can change admin settings and export a configuration file that, according to the record, contains the camera's admin credentials and credentials for other systems on your network.

If your company has these cameras in conference rooms, the camera is not the only thing at risk. The passwords stored inside it may be too. This post covers what is confirmed, what is only claimed, what is not known, and what to do this week.

What happened with the Poly EagleEye Cube USB

On November 4, 2026, two CVE records were published for the HP Poly EagleEye Cube USB running firmware 1.3.1-001267. Both records were assigned by MITRE and point to a short write-up by the researcher who reported them.

• CVE-2026-39430 (login bypass): The record says the admin login process on the device is broken because the device itself does not enforce session management or access controls. An attacker with no login can change administrator settings, either with a modified client that skips the login step or a custom client that calls the admin functions directly. That includes exporting configuration files.
• CVE-2026-39431 (command injection): The record says one function on a management service reachable over USB does not properly check its input during certificate request (CSR) generation. That lets an attacker run commands as root, the highest level of control on the device.

What is confirmed and what is claimed

How serious is CVE-2026-39430?

CISA scored it 9.8 out of 10 with the vector AV:N/AC:L/PR:N/UI:N: reachable over a network, easy to do, no login and no user action needed. CISA also marked it "automatable: yes" and "technical impact: total" in its SSVC assessment. In plain terms, if an attacker can reach the camera's management functions, there is nothing stopping them from taking over its settings.

Two cautions. First, HP has not published its own severity score that we could find; the 9.8 comes from CISA's review of the record. Second, the records do not spell out exactly how an attacker reaches the device. The CVSS score assumes network access, the second flaw mentions a management service reachable over USB, and the researcher mentions the camera's Ethernet port. Until HP publishes details, assume both the USB connection (usually to a meeting-room PC) and any network cable are possible paths.

CVE-2026-39431: the root command injection

CISA scored this one lower, 7.2, because its vector says high privileges are required. The researcher's write-up describes it differently, saying an attacker without administrator access can run commands as root. If the first flaw means the admin login is not enforced anyway, the privilege bar for the second may be lower in practice. That is our reading of the two descriptions together, not something HP or the researcher has stated as a tested chain.

Is there a patch for the Poly EagleEye Cube USB?

Not that we could confirm. Neither CVE record lists a fixed version, a solution or a workaround. When we searched HP's support site on November 7, 2026, we did not find an HP security bulletin naming either CVE. HP's bulletin pages load dynamically, so that search is not proof that nothing exists. Check HP's security bulletin page yourself before deciding your next step, and check it again each week.

Why it matters for a business

Meeting room cameras tend to be set up once and forgotten. They often sit on the same network as staff laptops, plugged into a shared room PC that anyone can walk up to. Three things make this flaw worth your time:

1. Credentials leave the building with the config file. The record says the export contains the admin credentials and credentials for other network systems. If the same password is used on other devices, or the camera stores a login for another system, one camera becomes a key to more of your network.
2. A rooted device is a quiet foothold. A camera with root access taken over is a computer on your network that your security tools probably do not watch.
3. No fix means the controls are on you. Until HP ships firmware, the only protection is how you connect, isolate and manage the device.

What to do this week

If you are not sure what the camera is connected to or what logins it holds, that is the first thing to find out. Our security hardening service covers this kind of device review and network separation.

Poly EagleEye Cube questions people are asking

Is the Poly EagleEye Cube USB being hacked right now?

There is no known exploitation. CISA's assessment for both CVEs lists exploitation as "none." That can change, especially since the flaw is rated easy to automate.

Which firmware version is affected by CVE-2026-39430?

The record names HP Poly EagleEye Cube USB firmware 1.3.1-001267. It does not say whether earlier or later versions are affected.

Is there a fix for CVE-2026-39430 or CVE-2026-39431?

No fixed firmware is listed in either CVE record, and we did not find an HP bulletin for them as of November 7, 2026. Check HP's security bulletin page directly.

Does this affect other Poly or HP cameras?

The records only name the EagleEye Cube USB. Nothing we could confirm says other models are affected, and nothing says they are safe.

What is the difference between the two CVEs?

CVE-2026-39430 lets someone with no login change admin settings and export a config file with credentials in it. CVE-2026-39431 lets an attacker run commands as root through a management function reachable over USB.

Should we unplug the cameras?

Not necessarily. Removing the network cable when it is not needed, isolating the device, locking down the room PC and changing the stored passwords lowers the risk while you wait for HP.

The bigger lesson

Every device with a login and a saved password is part of your security, including the camera in the conference room. If nobody owns the job of tracking firmware, isolating devices and rotating stored credentials, a flaw like this sits unnoticed until someone else finds it first.

See our security hardening service or request a quote to have your meeting room and network devices reviewed.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: CVE-2026-39430 record; CVE-2026-39431 record; Researcher write-up on GitHub.