id: polycom-hdx-web-exposure

info:
  name: Polycom HDX - Web Interface Exposure
  author: 0x_Akoko
  severity: low
  description: |
    Detecetd Polycom HDX video conferencing system web interface, potentially allowing unauthorized access to device configuration and video calls.
  reference:
    - https://www.polycom.com/products-services/hd-telepresence-video-conferencing.html
    - https://support.polycom.com/content/support/north-america/usa/en/support/video.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"Polycom HDX"
    fofa-query: title="Polycom" && body="HDX"
  tags: polycom,hdx,iot,exposure,video-conferencing

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "Polycom", "u_keepalive.htm", "u_status.xml")'
        condition: and
# digest: 4b0a00483046022100fc508c9d18ea6c78e01e3693776e07bc644eca6eb6ad91c9b52e95a5a95ce49502210088ffd7af62a11656bc5778127de058743e0c76ee161231635cd8a00d31f7a923:922c64590222798bb761d5b6d8e72950