CVE-2025-22918

CVE-2025-22918 affects Polycom RealPresence Group 500 devices running version 20 or earlier. The vulnerability stems from insecure permissions caused by automatically loaded cookies, which enable unauthorized access to administrator functions. This issue, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for authentication or user interaction.

Attackers can exploit this vulnerability remotely over the network without privileges. By leveraging the insecure cookie handling, unauthenticated remote actors gain access to admin-level functions, resulting in the leakage of sensitive user information. No integrity or availability impacts are associated with successful exploitation.

Advisories reference a GitHub repository at https://github.com/MinggongKs/Polycom/blob/main/README.md for further details, though specific mitigation or patch information is not detailed in the CVE publication from February 3, 2025.