In certain scenarios when the admin has enabled Interactive Connectivity Establishment

CVE-2026-0826 is a stack-based buffer overflow in HP Poly Voice phones on the Linux platform, triggered while parsing SDP a=candidate data for Interactive Connectivity Establishment (ICE). Rapid7 demonstrated unauthenticated remote code execution as root against a VVX 450, and HP's published affected ranges map to VVX before UCS 6.4.8, Trio 8300 before 8.1.7, and Trio 8500/8800 before 7.2.8.

In a vacuum this looks like a classic critical appliance RCE, and technically it is nasty. In real enterprise deployments, the biggest reality check is that ICE is not enabled by default, and these phones usually sit on internal voice networks rather than on the public internet; that sharply reduces reachable population and makes this more of a post-initial-access lateral-movement amplifier than a universal internet-fire alarm.

Why this verdict

• Down from hypothetical CRITICAL: exploitation requires ICE to be enabled, which HP/Rapid7 say is not the default; that sharply narrows the reachable population.
• Down again: the attacker usually needs internal network reachability to voice infrastructure. That implies post-initial-access or a segmentation failure, not broad internet-edge exposure across most enterprises.
• Back up to HIGH: where those prerequisites are met, this is still pre-auth network RCE as root with a public Metasploit path, and desk phones often have weak detection, weak ownership, and long firmware lag.

Why not higher?

Because this is not a universal one-packet internet-edge problem across the whole install base. The attack path compounds two real brakes — non-default configuration and typical voice-network locality — which materially reduce both attacker reach and exposed population.

Why not lower?

Because once the path is open, the impact is not theoretical or partial: it is unauthenticated remote code execution with root privileges. Public exploit work already exists, and embedded voice devices are exactly the kind of unmanaged internal nodes attackers love for stealthy footholds.

1. Disable ICE where unused — This is the best choke point because it removes the vulnerable feature path entirely. Review Poly provisioning templates and phone config for ICE-related settings and disable them within 30 days for all deployments that do not explicitly require ICE.
2. Constrain SIP reachability — Allow SIP/SDP traffic to phones only from approved call-control, SBC, and UC management systems; block workstation, server, and guest segments from talking directly to phone SIP listeners. Put these ACL changes in place within 30 days to reduce lateral movement opportunity.
3. Lock down voice VLAN east-west paths — Treat phones as semi-trusted embedded endpoints, not harmless peripherals. Restrict routing from user LANs into voice VLANs and limit phone egress so a compromised handset cannot pivot broadly; deploy within 30 days.
4. Inventory firmware now — Build a device list keyed by model and UCS version so you can separate real exposure from noise and stage firmware remediation cleanly. Complete the inventory and exception list within 30 days.
5. Watch SIP for oversized ICE candidates — Add detections for anomalous SIP messages carrying unusually long SDP a=candidate attributes or unusual OPTIONS/INVITE probing against phones. This will not prevent exploitation by itself, but it improves detection on a class of devices that usually lacks EDR; deploy within 30 days.

Run this from an auditor workstation or jump host with network reachability to the phone's SIP port; you do not run it on the phone itself. Invoke it as python3 poly_cve_2026_0826_check.py 10.20.30.40 or python3 poly_cve_2026_0826_check.py 10.20.30.40 5060; no admin rights are required, but your source host must be allowed to send UDP to the target.

#!/usr/bin/env python3
# poly_cve_2026_0826_check.py
# Best-effort remote check for HP Poly Voice CVE-2026-0826.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/network error

import re
import sys
import socket
import uuid
from itertools import zip_longest

FIXED = {
    'vvx': '6.4.8',
    'trio_8300': '8.1.7',
    'trio_8500': '7.2.8',
    'trio_8800': '7.2.8',
}


def norm_version(v):
    parts = re.findall(r'\d+', v or '')
    return [int(x) for x in parts]


def version_lt(a, b):
    aa = norm_version(a)
    bb = norm_version(b)
    for x, y in zip_longest(aa, bb, fillvalue=0):
        if x < y:
            return True
        if x > y:
            return False
    return False


def classify_product(text):
    t = text.lower()
    if 'vvx' in t:
        return 'vvx'
    if 'trio 8300' in t or 'trio_8300' in t:
        return 'trio_8300'
    if 'trio 8500' in t or 'trio_8500' in t:
        return 'trio_8500'
    if 'trio 8800' in t or 'trio_8800' in t:
        return 'trio_8800'
    return None


def extract_version(text):
    patterns = [
        r'\bversion\s*[:/ ]\s*([0-9]+(?:\.[0-9]+){1,4})',
        r'\bucs\s*[:/ ]\s*([0-9]+(?:\.[0-9]+){1,4})',
        r'\b([0-9]+(?:\.[0-9]+){2,4})\b',
    ]
    for p in patterns:
        m = re.search(p, text, re.I)
        if m:
            return m.group(1)
    return None


def build_options(target_ip):
    branch = uuid.uuid4().hex[:8]
    callid = uuid.uuid4().hex
    return (
        f"OPTIONS sip:{target_ip} SIP/2.0\r\n"
        f"Via: SIP/2.0/UDP 0.0.0.0:5061;branch=z9hG4bK-{branch}\r\n"
        f"From: <sip:audit@local>;tag=ng1\r\n"
        f"To: <sip:{target_ip}>\r\n"
        f"Call-ID: {callid}\r\n"
        f"CSeq: 1 OPTIONS\r\n"
        f"Max-Forwards: 70\r\n"
        f"Contact: <sip:[email protected]:5061>\r\n"
        f"Accept: application/sdp\r\n"
        f"Require: ice\r\n"
        f"Content-Length: 0\r\n\r\n"
    ).encode()


def main():
    if len(sys.argv) not in (2, 3):
        print('UNKNOWN - usage: python3 poly_cve_2026_0826_check.py <ip> [port]')
        sys.exit(3)

    host = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) == 3 else 5060

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(3.0)

    try:
        sock.sendto(build_options(host), (host, port))
        data, _ = sock.recvfrom(8192)
    except Exception as e:
        print(f'UNKNOWN - no SIP response from {host}:{port} ({e})')
        sys.exit(2)
    finally:
        sock.close()

    text = data.decode(errors='ignore')
    flat = text.replace('\r', ' ').replace('\n', ' ')

    product = classify_product(flat)
    version = extract_version(flat)
    ice_seen = ('ice' in flat.lower())

    if not product or not version:
        print('UNKNOWN - got SIP response but could not confidently fingerprint Poly model/version')
        sys.exit(2)

    fixed = FIXED.get(product)
    if not fixed:
        print(f'UNKNOWN - unsupported product fingerprint {product}, version {version}')
        sys.exit(2)

    if version_lt(version, fixed):
        if ice_seen:
            print(f'VULNERABLE - {product} version {version} is below fixed {fixed} and SIP response indicates ICE support')
            sys.exit(1)
        else:
            print(f'UNKNOWN - {product} version {version} is below fixed {fixed}, but ICE enablement could not be confirmed remotely')
            sys.exit(2)
    else:
        print(f'PATCHED - {product} version {version} is at or above fixed {fixed}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD entry for CVE-2026-0826
2. Rapid7 technical disclosure
3. Rapid7 Metasploit exploit PR
4. OpenCVE record with CNA metadata and affected versions
5. CISA Known Exploited Vulnerabilities Catalog
6. Canadian Centre for Cyber Security advisory AV26-539
7. CSO Online coverage with fixed versions