Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches
A critical vulnerability (CVE-2026-0826) has been identified in HP Poly Voice VoIP phone models, allowing for remote code execution with root privileges. The flaw, triggered by a stack-based buffer overflow when processing SDP data with ICE enabled, presents a significant risk to enterprise networks. Organizations are urged to apply available patches and disable ICE if not required to mitigate the threat.
The vulnerability, tracked as CVE-2026-0826 and assigned a CVSS score of 9.2, resides within the parsing of Session Description Protocol (SDP) attributes in HP Poly Voice VoIP phones. Specifically, the parsing function, called during ICE-enabled processing, copies incoming strings into a 256-byte stack buffer without length checks, creating an opportunity for attackers to supply malicious candidate attributes. This can lead to a crash, allowing an attacker to gain control of the program counter, registers, and stack data. Attackers can then utilize Return-Oriented Programming (ROP) chains to bypass security mitigations like ASLR and NX, achieving arbitrary code execution.
Rapid7’s Douglas McKee highlighted the serious implications, noting that these devices are often located in trusted areas like conference rooms and offices, making them attractive targets. A successful exploit could provide attackers with a persistent foothold, enabling them to intercept communications, move laterally within the network, and potentially conduct sophisticated attacks such as vishing, deepfakes, or fraudulent financial authorization attempts. The vulnerability’s impact extends beyond simple eavesdropping, representing a potential pathway for significant data compromise and disruption.