An issue exists in Poly EagleEye Director II prior to 2.2.2.1. os.system command injection can be achieved by an admin.
poly eagleeye_director_ii_firmware