CVE-2002-0626

Vulnerability

Polycom ViewStation video conferencing devices running firmware versions prior to 7.2.4 have a default null password set for the built-in administrator account. This means that no password is required to log in with administrative privileges. The vulnerability exists in the device's web interface and management console.

Exploitation

An attacker with network access to the ViewStation can exploit this by simply connecting to the device's management interface (typically HTTP or HTTPS) and logging in with the username admin and leaving the password field empty. No prior authentication or user interaction is required. The default configuration does not enforce any password change on first login.

Impact

Successful exploitation grants the attacker full administrative control over the ViewStation device. This includes the ability to modify system settings, access and manipulate video/audio streams, change network configurations, upload malicious firmware, and potentially pivot to other devices on the network. The compromise is at the highest privilege level.

Mitigation

Polycom addressed this issue in firmware version 7.2.4 [1]. Users should upgrade to this version or later. As a general security practice, administrators should also change default passwords immediately upon deployment. If upgrading is not possible, restrict network access to the management interface using firewall rules or VLAN segmentation. This CVE is not listed on CISA's Known Exploited Vulnerabilities catalog.