Medium severity · published Jul 22, 2025
CVE-2025-43486
Poly Clariti Manager - Multiple Security Vulnerabilities
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
A potential stored cross-site scripting vulnerability has been
identified in the Poly Clariti Manager for versions prior to 10.12.1. The
website allows user input to be stored and rendered without proper
sanitization. HP has addressed the issue in the latest software update.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Poly Clariti Manager · HP Inc.
See HP Security Bulletin reference for affected versions. · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-43486
Vendor Advisory
https://support.hp.com/us-en/document/ish_12781425-12781447-16/hbsbpy04037
More from Poly Clariti Manager
9.8
CVE-2024-41912
A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices
8.8
CVE-2024-41913
Clariti Manager – Arbitrary File Upload
7.2
CVE-2025-43022
Poly Clariti Manager - Multiple Security Vulnerabilities
6.8
CVE-2025-43487
Poly Clariti Manager - Multiple Security Vulnerabilities
6.8
CVE-2025-43020
Poly Clariti Manager - Multiple Security Vulnerabilities