Why an HP Poly VoIP Phones Bug Could Become an Enterprise Foothold
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0826 | Buffer Overflow RCE in HP Poly Linux Voice Products When ICE Is Enabled CVE-2026-0826 is a critical buffer overflow (CWE-121) in HP's Poly voice products that run on the Linux platform. It is reachable over the network without privileges or user interaction, but only in scenarios where the administrator has enabled Interactive Connectivity Establishment (ICE), and HP's CVSS 4.0 vector marks the attack as requiring those precise timing conditions. A successful exploit could let a remote attacker execute arbitrary code on the affected phone or voice device, with high impact on its confidentiality, integrity and availability, turning a compromised endpoint into a potential foothold inside the enterprise network. Organizations running HP/Poly Linux-based voice endpoints (including VoIP phones) with ICE enabled are affected; the available advisory data does not enumerate specific models, version ranges or fixed firmware releases. There is no public proof-of-concept and the flaw is not yet in CISA KEV, but EPSS assigns a 32.2% probability of exploitation within 30 days (98th percentile) and news coverage indicates defenders are being urged to patch promptly. Do: Inventory HP/Poly Linux-based voice endpoints and check each device's configuration for ICE being enabled; disable ICE where it is not required and avoid exposing SIP/management interfaces directly to the internet. Apply the fixed firmware from HP's official security advisory once released - HP is the assigning CNA, so monitor hp.com advisories, as the available data does not yet list specific patched version numbers. | 9.2 | 32% |
| mass~1M+ Linux-based Poly voice endpoints (subset of Poly's multi-million-device enterprise installed base; only ICE-enabled devices affected) |
Full article545 words · extracted from securityaffairs.com · click to collapse
Rapid7 details a critical unauthenticated overflow in HP Poly VoIP phones that can lead to root RCE, with patches available for affected models.
Rapid7’s latest disclosure on CVE-2026-0826 should get serious attention from anyone running HP Poly VoIP phones in an enterprise setting. It’s a critical unauthenticated stack-based buffer overflow that can give a remote attacker root-level code execution on affected devices, and the bug sits in SDP parsing for ICE-enabled phones.
“Rapid7 Labs conducted a zero-day research project against an HP Poly VVX 450 Voice over Internet Protocol (VoIP) phone. This research resulted in the discovery of a critical unauthenticated stack-based buffer overflow vulnerability, CVE-2026-0826.” reads the report published by Rapid7. “A remote attacker can leverage CVE-2026-0826 to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. “
When the phone processes SDP data, it can parse a candidate attribute and copy the input into a 256-byte stack buffer without checking length, which means a long enough string can overflow the stack.
“No length check is performed to ensure the incoming string length is less than 256 bytes. Therefore by providing a candidate attribute whose length is greater than 256 bytes, a stack-based buffer overflow will occur.” states the report.
An attacker can send a specially crafted SIP INVITE request containing an oversized ICE candidate attribute, overflowing a 256-byte buffer without authentication. Testing showed the flaw allows attackers to overwrite key memory registers, including the program counter, potentially leading to remote code execution and full control of the device.
From there, the path to exploitation is straightforward enough to be dangerous: ASLR is present, NX is enabled, but ASLR does not behave as it should on the device, and shared libraries load at fixed addresses that make a ROP chain practical..
“Inspecting the polyapp binary with the checksec tool we can see that No Execute (NX) is enabled, so the stack data will not be executable.” continues the report. “As we will not be able to execute a payload directly on the stack, we can overcome this by using a Return Oriented Programming (ROP) chain to bypass the NX mitigation.”
The issue affects firmware version 6.4.7.4477 and could be exploited over the network via SIP traffic
Rapid7 confirmed the bug across the VVX line, including the VVX 150, 250, 350, and 450, plus the Trio 8800, 8500, and 8300 models. The recommended fix is simple in theory and non-negotiable in practice: disable ICE where it isn’t needed, then move all affected devices to the patched firmware releases HP published.
“HP Poly recommends that administrators disable ICE connectivity in environments where it is not required.” concludes the report. “All affected Poly Voice devices should be updated to the latest available UCS release using the Poly Lens Device Management application.”
The real risk here isn’t just that a desk phone can be popped. As Rapid7 notes, these devices sit in trusted places like conference rooms and offices, which makes them useful footholds for spying, lateral movement, and voice-based fraud; in plain terms, a compromised phone can do a lot more than ruin your day, and it won’t ask for permission first.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, HP Poly VoIP phones)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/193045/security/why-an-hp-poly-voip-phones-bug-could-become-an-enterprise-foothold.html