| Poly Studio X72 (PATX-STX-72R)
|
|
Security Grade
Calculator v
|
Poly Studio X72 all-in-one video bar
Release Date: 2024-09-24 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The user guide describes accessible power connections and physical recovery controls. Evidence boundary: The methodology includes interruption of power under physical tampering. Rare is a qualitative exposure judgment, not an asserted exploit rate or successful extraction of encrypted data. Additional primary evidence: source 2.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
HP lists X72 in CVE-2025-14432, involving sensitive TAC configuration data in administrator-visible logs. Evidence boundary: The bulletin gives fixed PolyOS 4.6.1-444242. TAC is outside this case; the score records model-platform vulnerability history, not active exposure of the selected Poly Video workflow.
|
| Prior attacks
|
None
|
🔗 Proof
|
No exact-X72 field attack campaign was established in the reviewed manufacturer releases and advisory. Evidence boundary: Bounded documentary finding through 24 October 2026. A published vulnerability is not itself an observed exploitation campaign; None does not prove no attack ever occurred. Additional primary evidence: source 2.
|
| Updatability
|
Very common
|
🔗 Proof
|
Manufacturer release records document successive X72 firmware releases and a later security-fixed build. Evidence boundary: This credits demonstrated continuing maintenance, not merely an update button. The historical 4.4 case is not presented as the latest recommended software. Additional primary evidence: source 2; source 3.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The configured HTTPS administrator path uses credentials; the call policy permits nonsecure peers. Evidence boundary: Partial is a reasoned mapping across these declared paths. No claim of universal mutual peer authentication, administrator MFA or an authenticated caller identity follows from encrypted transport alone. Additional primary evidence: source 2.
|
| Communications
|
No encryption
|
🔗 Proof
|
The guide explicitly permits unencrypted calls under When Available; this case includes such a call. Evidence boundary: The finding concerns actual audio/video application payload. It does not describe HTTPS management or every conference as plaintext.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The X72-inclusive white paper specifies AES-128 Android FDE for resident user data, including device configurations, certificates and logs. Evidence boundary: Non-sensitive read-only partitions are excluded from that encryption statement. The paper explicitly assigns FBE to X52, X32 and touch controllers; those exceptions are not transplanted to X72. The model-inclusive design description is not a physical flash test.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Local administrator credentials can be changed; local and remote access passwords can be configured. Evidence boundary: Basic describes the declared local-administrator deployment. A complete individual-user lifecycle or directory integration is not credited merely because optional enterprise services exist.
|
| Authentication
|
Basic
|
🔗 Proof
|
Administrator settings and the web interface require the configured administrator password. Evidence boundary: Basic is used for this credential-based configuration. Optional directory services are not treated as enabled, and full multi-factor or individual-user authentication is not inferred.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
The guide documents failed-login counting and timed administrator lockout; both are enabled in this case. Evidence boundary: Administrator-selected nonzero thresholds define this case. The guide allows disabling the feature, so this is not a factory-default claim or an invented numerical lockout policy.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
With call-detail recording enabled, the product records incoming, outgoing and missed call details. Evidence boundary: Call records and device logs support Partial logging. These sources do not establish a complete identity-based audit of every user and access event in the chosen workflow. Additional primary evidence: source 2.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
The setup guide allows replacing the serial-derived default; this case uses a unique replacement administrator password. Evidence boundary: The default is the final six serial-number characters. Replacement is explicitly part of this configured case, not a claim that every model/version universally forces the change. Interpretation: Option 2 follows the disclosed first-setup credential interpretation. No enforced periodic rotation or unverified complexity policy is claimed.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Assessment scope
Documentary configured-deployment case study of Poly Studio X72 PATX-STX-72R running Poly VideoOS 4.4.0.416273 in Poly Video Mode. Local management uses HTTPS and an administrator-selected unique replacement password. Failed-admin-login lockout and a nonzero lock duration are explicitly enabled; numerical thresholds are not invented. Require AES Encryption for Calls is set to When Available, and the assessed workflow includes a call to a peer without encryption. Call-detail recording is enabled. External directory authentication, SSH/telnet management and Microsoft Teams Admin Center configuration are outside the declared workflow. These settings define the assessed case; they are not claimed as universal factory defaults or an observed installation. The 4.4 administration guide explicitly includes X72. The model-inclusive March 2025 privacy/security white paper supplies the documented storage design; no flash extraction by the author is claimed.
Method and evidence boundaries
This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark.
Calculated IDRS: 2 + 2 + 2 = 6 (B).
Date basis: The manufacturer announcement dated 24 September 2024 names the Studio X72 and explicitly lists it as available now. This is the documented announcement/availability date, not a separately verified first shipment in every country.
Date source: https://www.hp.com/us-en/newsroom/press-releases/2024/hp-transforms-future-of-work.html
Patch/support context: The baseline 4.4.0.416273 was released in November 2024 and explicitly supports X72. Later vendor releases exist. HP lists X72 with fixed PolyOS 4.6.1-444242 for CVE-2025-14432; that advisory concerns Microsoft TAC changes, not provisioning-server or device-WebUI changes. It is not used to claim that this Poly Video Mode case exercises the vulnerable TAC workflow.
Product-specific boundaries: The case is an explicitly selected deployment supported by documentation; no physical device, call capture or configuration export was inspected. Communications 3 is conditional on the declared call to an unencrypted peer; an encryption-required deployment would differ. The storage source is a March 2025 model-inclusive design white paper, not a firmware-4.4 flash dump. It supports the manufacturer-documented design with that temporal boundary. A distinct brand and functional type are used; the parent company HP is not concealed. Rare and None remain documented qualitative judgments or bounded search results, not mathematical statements of universal absence or frequency.
