Loading story…
Rapid7 disclosed CVE-2026-0826, a critical unauthenticated stack-based buffer overflow in HP Poly VVX and Trio VoIP phones that can allow remote code execution as root. The flaw resides in SDP parsing of ICE candidate attributes within the polyapp binary when the non-default ICE feature is enabled. Rapid7 demonstrated exploitation against a Poly VVX 450 running firmware 6.4.7.4477, showing that existing mitigations were not sufficient in practice: NX was enabled, but the binary lacked PIE, and some shared libraries loaded at fixed addresses despite nominal ASLR, enabling a ROP-based exploit. HP said the issue affects all VVX models and several Trio conference phones, assigned it a CVSSv4 9.2, and released patched firmware while advising administrators to disable ICE if it is not required.
The disclosure also warned that compromised enterprise desk phones can become stealthy footholds for persistence, lateral movement, traffic interception, and call manipulation, while exposing sensitive audio from executive offices and conference rooms. Rapid7 said the risk extends beyond traditional espionage because control of trusted business phones could support AI-enabled impersonation, including vishing and deepfake-assisted fraud, underscoring that VoIP endpoints should be treated as fully networked computers rather than benign office appliances.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
HP confirmed that all VVX models and several Trio conference phone models are affected by CVE-2026-0826, assigned it a CVSS v4 score of 9.2, and released patched firmware versions. HP also recommended disabling ICE where it is not needed.
Rapid7 disclosed CVE-2026-0826, a critical unauthenticated stack-based buffer overflow affecting HP Poly VVX and Trio VoIP devices that can enable remote code execution. The flaw is in SDP parsing of ICE candidate attributes in the polyapp binary when the non-default ICE feature is enabled.
Cisco’s AI threat intelligence team reported that single-turn safety benchmarks understate real-world risk and that all 15 tested closed frontier models failed a meaningful share of adaptive multi-turn attacks. The study found attack success rates rose sharply in multi-turn testing and that deployment configuration choices, such as reasoning mode, could materially change outcomes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
thenewstack.io
Open sourcerapid7.com
Open sourcerapid7.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HP disclosed **CVE-2026-0826**, a critical buffer overflow vulnerability in certain **Poly Voice** devices running on Linux that can lead to remote code execution and possible remote control of affected systems. The flaw carries a **CVSS v4.0 score of 9.2** and is remotely exploitable with low attack complexity, no privileges, and no user interaction, but only in deployments where an administrator has enabled **Interactive Connectivity Establishment (ICE)**. According to HP bulletin **`HPSBPY04083`**, affected products include **VVX**, **Trio 8300**, **Trio 8500**, and **Trio 8800** devices. HP urged customers to update to the latest **UCS firmware** through **HP Poly Lens** and advised disabling ICE connectivity where it is not needed. The issue was reported by **Stephen Fewer of Rapid7** and is classified under **`CWE-121`**.
Jun 29, 2026
Rapid7 disclosed **CVE-2026-2329**, a critical unauthenticated **stack-based buffer overflow** (CWE-121) in the Grandstream **GXP1600** series VoIP phones that can be exploited for **remote code execution (RCE) as `root`**. The flaw is reachable via the phone’s web-based HTTP API in default configurations, specifically the endpoint ` /cgi-bin/api.values.get `, and impacts all models sharing the common firmware image: **GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630**. Public scoring cited includes **CVSS v4.0 9.3 (Critical)** with network attack vector and no privileges or user interaction required. Rapid7 demonstrated exploitability by developing a **Metasploit** exploit module (plus a post-exploitation module) showing unauthenticated compromise of a vulnerable device (e.g., GXP1630 on firmware **1.0.7.79**) and subsequent credential collection (including local and SIP accounts). Rapid7 also highlighted operational risk beyond device takeover: with root access, an attacker could alter SIP configuration to route calls through attacker-controlled infrastructure, enabling covert call interception. Grandstream has released a firmware fix, **version 1.0.7.81**, to remediate the issue, and the disclosure is tracked via Grandstream PSIRT and Metasploit references.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-20230**, a critical flaw in Cisco Unified Communications Manager (**Unified CM**) and Unified CM Session Management Edition (**Unified CM SME**), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform **SSRF**, write arbitrary files to the underlying operating system, and potentially escalate privileges to **root**; researchers also described a path to unauthenticated remote code execution. Exploitation requires the **WebDialer** service to be enabled, although Cisco notes it is disabled by default. Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with `file://` file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in **Unified CM 14SU6** and **15SU5**, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable **WebDialer** to reduce exposure on widely deployed enterprise voice platforms.
Aug 15, 2026