CVE-2022-26479

CVE-2022-26479 is a critical authentication bypass vulnerability affecting Poly EagleEye Director II devices running firmware versions prior to 2.2.2.1. An attacker can exploit an rsync backdoor to create a specific file, which then causes all API calls to execute with administrative privileges without requiring authentication. This vulnerability has a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or inclusion in the KEV catalog, the vulnerability has garnered significant community discussion, indicating potential interest from threat actors.