Back Securityaffairs.Co

Why an HP Poly VoIP Phones Bug Could Become an Enterprise Foothold

Securityaffairs.Co •Pierluigi Paganini • June 3, 2026

Rapid7 details a critical unauthenticated overflow in HP Poly VoIP phones that can lead to root RCE, with patches available for affected models. Rapid7’s latest disclosure on CVE-2026-0826 should get serious attention from anyone running HP Poly VoIP phones in an enterprise setting. It’s a critical unauthenticated stack-based buffer overflow that can give a remote […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Buffer Overflow in HP Poly VoIP Phones Exposes Enterprises to Attacks HP has patched a critical buffer overflow vulnerability, CVE-2026-0826, affecting its Poly VoIP phones, including the VVX and Trio series. Discovered by Rapid7, the flaw allows unauthenticated attackers to gain root access, potentially enabling eavesdropping and voice data exploitation for deepfake impersonation. The vulnerability, rated 9.2 on the CVSS scale, is associated with the Interactive Connectivity Establishment (ICE) feature, which should be disabled if not in use. An exploit module for this vulnerability has been released for the Metasploit framework, raising concerns for enterprises utilizing these devices. HP has released fixes in versions 6.4.8, 8.1.7, and 7.2.8 for the affected devices. Organizations are urged to apply the patches immediately to mitigate risks. 2 sources 72

Extracted Entities

Why an HP Poly VoIP Phones Bug Could Become an Enterprise Foothold

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)