CVE-2026-0826: Critical unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones (FIXED)
PatchHP Poly VVXHP Poly Trio Read at Rapid7 Blog
Below is the opening; the full story is at Rapid7 Blog.
From Rapid7 Blog
Overview
Rapid7 Labs conducted a zero-day research project against an HP Poly VVX 450 Voice over Internet Protocol (VoIP) phone. This research resulted in the discovery of a critical unauthenticated stack-based buffer overflow vulnerability, CVE-2026-0826. A remote attacker can leverage CVE-2026-0826 to achieve unauthenticated remote code execution (RCE) with root privileges on a target device.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.