Poly Studio X72 (PATX-STX-72R)

Poly Studio X72 (PATX-STX-72R)
Security Grade B Calculator v1	Poly Studio X72 all-in-one video bar Brand: Poly (Parent: HP Inc.) Category: All-in-one network video conferencing endpoint • Model / Gen: Studio X72 model, introduced in 2024; no ordinal generation claimed. PATX-STX-72R (radio-equipped X72) Release Date: 2024-09-24 • Status: Classification Date: 2026-10-25 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	The user guide describes accessible power connections and physical recovery controls. Evidence boundary: The methodology includes interruption of power under physical tampering. Rare is a qualitative exposure judgment, not an asserted exploit rate or successful extraction of encrypted data. Additional primary evidence: source 2.
Known vulnerabilities	Rare	🔗 Proof	HP lists X72 in CVE-2025-14432, involving sensitive TAC configuration data in administrator-visible logs. Evidence boundary: The bulletin gives fixed PolyOS 4.6.1-444242. TAC is outside this case; the score records model-platform vulnerability history, not active exposure of the selected Poly Video workflow.
Prior attacks	None	🔗 Proof	No exact-X72 field attack campaign was established in the reviewed manufacturer releases and advisory. Evidence boundary: Bounded documentary finding through 24 October 2026. A published vulnerability is not itself an observed exploitation campaign; None does not prove no attack ever occurred. Additional primary evidence: source 2.
Updatability	Very common	🔗 Proof	Manufacturer release records document successive X72 firmware releases and a later security-fixed build. Evidence boundary: This credits demonstrated continuing maintenance, not merely an update button. The historical 4.4 case is not presented as the latest recommended software. Additional primary evidence: source 2; source 3.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The configured HTTPS administrator path uses credentials; the call policy permits nonsecure peers. Evidence boundary: Partial is a reasoned mapping across these declared paths. No claim of universal mutual peer authentication, administrator MFA or an authenticated caller identity follows from encrypted transport alone. Additional primary evidence: source 2.
Communications	No encryption	🔗 Proof	The guide explicitly permits unencrypted calls under When Available; this case includes such a call. Evidence boundary: The finding concerns actual audio/video application payload. It does not describe HTTPS management or every conference as plaintext.
Storage	Encrypted with up-to-date encryption	🔗 Proof	The X72-inclusive white paper specifies AES-128 Android FDE for resident user data, including device configurations, certificates and logs. Evidence boundary: Non-sensitive read-only partitions are excluded from that encryption statement. The paper explicitly assigns FBE to X52, X32 and touch controllers; those exceptions are not transplanted to X72. The model-inclusive design description is not a physical flash test.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Local administrator credentials can be changed; local and remote access passwords can be configured. Evidence boundary: Basic describes the declared local-administrator deployment. A complete individual-user lifecycle or directory integration is not credited merely because optional enterprise services exist.
Authentication	Basic	🔗 Proof	Administrator settings and the web interface require the configured administrator password. Evidence boundary: Basic is used for this credential-based configuration. Optional directory services are not treated as enabled, and full multi-factor or individual-user authentication is not inferred.
Brute-force protection	Exist	🔗 Proof	The guide documents failed-login counting and timed administrator lockout; both are enabled in this case. Evidence boundary: Administrator-selected nonzero thresholds define this case. The guide allows disabling the feature, so this is not a factory-default claim or an invented numerical lockout policy.
Event logging	Partial logging	🔗 Proof	With call-detail recording enabled, the product records incoming, outgoing and missed call details. Evidence boundary: Call records and device logs support Partial logging. These sources do not establish a complete identity-based audit of every user and access event in the chosen workflow. Additional primary evidence: source 2.
Passwords	Require change after setup	🔗 Proof	The setup guide allows replacing the serial-derived default; this case uses a unique replacement administrator password. Evidence boundary: The default is the final six serial-number characters. Replacement is explicitly part of this configured case, not a claim that every model/version universally forces the change. Interpretation: Option 2 follows the disclosed first-setup credential interpretation. No enforced periodic rotation or unverified complexity policy is claimed.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Poly VideoOS 4.4.0.416273 (assessed historical build; Poly Video Mode). (Companion App: Built-in web administration; optional Poly Lens management. Poly Content App is not supported by VideoOS 4.4.)
Hardware (CPU / GPU)	CPU: Not publicly disclosed in cited manufacturer documentation. • GPU: Not publicly disclosed in cited manufacturer documentation.
Memory & Storage	Memory: Not publicly disclosed in cited manufacturer documentation. • Storage: Not publicly disclosed in cited manufacturer documentation.
Power, Battery & Charging	Battery: Not battery-operated in the documented installation; requires the supplied external power adapter. • Power: External auto-sensing AC power adapter (included). • Charging: Not applicable to normal operation: externally powered video bar.
Display & Camera	Display: No integrated meeting display; connects one or two external HDMI monitors, with up to two 4K monitors subject to provider support. • Camera: Dual-lens 4K UHD camera system (3840 x 2160); 120-degree wide and 70-degree narrow horizontal fields of view; integrated privacy shutter.
Sound & Connectivity	Sound: Microphone array (two MEMS plus two second-order microphones) and two-way dual speakers; Poly NoiseBlockAI and Acoustic Fence. • Connectivity: Gigabit Ethernet; two HDMI outputs and one HDMI input; two USB-A ports; USB-C for Device Mode; 3.5 mm audio in/out and expansion-microphone connection.
Physical (Dimensions & Mass)	Dimensions: 840.18 x 135.4 x 117.93 mm (W x D x H), video bar only. • Mass: 3.30 kg (video bar only; excludes optional TC10 controller).

Assessment scope

Documentary configured-deployment case study of Poly Studio X72 PATX-STX-72R running Poly VideoOS 4.4.0.416273 in Poly Video Mode. Local management uses HTTPS and an administrator-selected unique replacement password. Failed-admin-login lockout and a nonzero lock duration are explicitly enabled; numerical thresholds are not invented. Require AES Encryption for Calls is set to When Available, and the assessed workflow includes a call to a peer without encryption. Call-detail recording is enabled. External directory authentication, SSH/telnet management and Microsoft Teams Admin Center configuration are outside the declared workflow. These settings define the assessed case; they are not claimed as universal factory defaults or an observed installation. The 4.4 administration guide explicitly includes X72. The model-inclusive March 2025 privacy/security white paper supplies the documented storage design; no flash extraction by the author is claimed.

Method and evidence boundaries

This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark.

Calculated IDRS: 2 + 2 + 2 = 6 (B).

Date basis: The manufacturer announcement dated 24 September 2024 names the Studio X72 and explicitly lists it as available now. This is the documented announcement/availability date, not a separately verified first shipment in every country. Date source: https://www.hp.com/us-en/newsroom/press-releases/2024/hp-transforms-future-of-work.html

Patch/support context: The baseline 4.4.0.416273 was released in November 2024 and explicitly supports X72. Later vendor releases exist. HP lists X72 with fixed PolyOS 4.6.1-444242 for CVE-2025-14432; that advisory concerns Microsoft TAC changes, not provisioning-server or device-WebUI changes. It is not used to claim that this Poly Video Mode case exercises the vulnerable TAC workflow.

Product-specific boundaries: The case is an explicitly selected deployment supported by documentation; no physical device, call capture or configuration export was inspected. Communications 3 is conditional on the declared call to an unencrypted peer; an encryption-required deployment would differ. The storage source is a March 2025 model-inclusive design white paper, not a firmware-4.4 flash dump. It supports the manufacturer-documented design with that temporal boundary. A distinct brand and functional type are used; the parent company HP is not concealed. Rare and None remain documented qualitative judgments or bounded search results, not mathematical statements of universal absence or frequency.

Hardware and general-information supplement

Supplement reviewed on 25 October 2026. Manufacturer model specifications and explicitly identified historical manuals support the added fields. Hardware capabilities do not imply that optional services, accessories or every capacity variant are enabled in the assessed case. Unpublished or unverified parameters are identified rather than guessed. Current sale/support status is separate from the original historical firmware/configuration assessment; the twelve security selections and original evidence have not been changed.

Specification evidence

• Generation: source 1.
• Status, Power, Sound: source 1.
• Dimensions, Mass: source 1.
• Operating system: source 1.
• Companion App: source 1; source 2.
• CPU, GPU, Memory, Storage, Camera, Connectivity: source 1; source 2.
• Battery, Charging, Display: source 1.

Specification qualifications

• Dimensions and mass refer to the standalone X72 video bar, excluding an optional TC10 controller and external displays.
• CPU, GPU, RAM and internal-storage capacity are not publicly disclosed in the cited model specifications. This is an evidence limitation, not proof these components are absent.
• The optional Status selector is left unset: the reviewed sources do not establish a reliable current sale/end-of-sale/end-of-life category. Firmware maintenance or an existing product page alone is not treated as proof of sale status.