An embedded test key and certificate within certain Poly Voice devices can be extracted with specialized reverse‑engineering tools. If a SIP service provider accepts this extracted credential without enforcing proper certificate validation, an attacker can impersonate the legitimate device, potentially gaining unauthorized access to voice communications and data. This vulnerability is classified as CWE-321, indicating insecure management of cryptographic keys.

HP Inc Edge E, HP Inc Trio 8300, and HP Inc VVX Poly Voice devices are susceptible. Version details are not explicitly listed in the advisory, so any firmware that includes the embedded test key may be affected.

The score of 8.2 reflects a high‑severity flaw, yet the EPSS score is under 1 %, suggesting low exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. Attackers must obtain the embedded key via reverse engineering and rely on a SIP provider that does not verify device certificates. The limited scope implies that exploitation is feasible mainly where the service provider’s validation is lax.