VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 7, 2003· Updated Apr 16, 2026

CVE-2002-0627

CVE-2002-0627

Description

Unicode-encoded requests bypass authentication and allow file disclosure on Polycom ViewStation web servers before version 7.2.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Unicode-encoded requests bypass authentication and allow file disclosure on Polycom ViewStation web servers before version 7.2.4.

Vulnerability

The web server component of Polycom ViewStation video conferencing devices prior to version 7.2.4 is vulnerable to an authentication bypass that allows reading arbitrary files. The flaw is triggered by sending specially crafted Unicode-encoded HTTP requests. The web server fails to properly decode or sanitize such requests, enabling access to protected resources without valid credentials.

Exploitation

An unauthenticated attacker with network access to the target ViewStation web server can exploit this by sending a GET request containing Unicode-encoded characters (e.g., %c0%ae%c0%ae for ..) to traverse directories and access files outside the web root. The server processes the request as if it were valid, bypassing the normal authentication checks [1].

Impact

Successful exploitation allows a remote, unauthenticated attacker to read arbitrary files on the device. This can lead to disclosure of sensitive information such as configuration files, passwords, or other proprietary data. The attack compromises confidentiality but does not allow direct modification or execution of code.

Mitigation

Polycom released firmware version 7.4.0 (and later) containing a fix. The vendor advisory [1] confirms the fix in version 7.2.4 or later (likely a typo; version 7.4.0 is explicitly listed). No workaround is mentioned. Devices running earlier firmware should be upgraded immediately.

References
  1. HP Poly Video & Voice Solutions - Formerly Polycom & Plantronics

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

16
  • Polycom/Viewstation Sp 3846 versions
    cpe:2.3:h:polycom:viewstation_128:6.5.1:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:h:polycom:viewstation_128:6.5.1:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_128:7.2:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_h.323:6.5.1:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_h.323:7.2:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_sp_384:6.5.1:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_sp_384:7.2:*:*:*:*:*:*:*
  • Polycom/Viewstation 5122 versions
    cpe:2.3:h:polycom:viewstation_512:6.5.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:h:polycom:viewstation_512:6.5.1:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_512:7.2:*:*:*:*:*:*:*
  • Polycom/Viewstation Dcp2 versions
    cpe:2.3:h:polycom:viewstation_dcp:6.5.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:h:polycom:viewstation_dcp:6.5.1:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_dcp:7.2:*:*:*:*:*:*:*
  • Polycom/Viewstation Fx Vs4000
    cpe:2.3:h:polycom:viewstation_fx_vs4000:4.1.5:*:*:*:*:*:*:*
  • Polycom/Viewstation Mp3 versions
    cpe:2.3:h:polycom:viewstation_mp:6.5.1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:h:polycom:viewstation_mp:6.5.1:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_mp:7.2:*:*:*:*:*:*:*
    • (no CPE)range: <7.2.4
  • Polycom/Viewstation V.352 versions
    cpe:2.3:h:polycom:viewstation_v.35:6.5.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:h:polycom:viewstation_v.35:6.5.1:*:*:*:*:*:*:*
    • cpe:2.3:h:polycom:viewstation_v.35:7.2:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.