CVE-2026-0826

Poly Voice – Possible Remote Control of Certain Poly Devices

Published Jun 1, 2026 CVSS 4.0 · 9.2 Critical EPSS 32.2% KEV · Not listed

Description

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable
remote code execution on Poly Voice products on the Linux platform.

Analysis

Technical impact

The vulnerability involves a buffer overflow (CWE-121) that can be triggered when Interactive Connectivity Establishment (ICE) is enabled on Poly Voice devices. This code, leading to full remote code execution on the Linux platform.

Affected Systems

Affected are HP Inc. Poly Trio 8300, 8500, and 8800 models running Linux. These devices are listed in the vendor product list.

Risk and Exploitability

With a CVSS score of 9.2 the flaw is classified as critical. The EPSS score is 32%, indicating a relatively high likelihood of exploitation, and the vulnerability is not currently listed in CISA's KEV catalog. The attack vector is likely over the network through ICE, meaning that any external or internal user who can reach the ICE service could potentially exploit the overflow.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HP Inc.

poly_trio_8300

unaffected

Version	Status	Constraints
`0`	affected	< 8.1.7

HP Inc.

poly_trio_8500

unaffected

Version	Status	Constraints
`0`	affected	< 7.2.8

HP Inc.

poly_trio_8800

unaffected

Version	Status	Constraints
`0`	affected	< 7.2.8

HP Inc.

poly_vvx

unaffected

Version	Status	Constraints
`0`	affected	< 6.4.8

No data.

Vendor Product Versions

Hp Inc.

Poly Trio 8300

Version	Status	Scheme	Platform
`[0,8.1.7)`	affected	generic	['linux']

Hp Inc.

Poly Trio 8500

Version	Status	Scheme	Platform
`[0,7.2.8)`	affected	generic	['linux']

Hp Inc.

Poly Trio 8800

Version	Status	Scheme	Platform
`[0,7.2.8)`	affected	generic	['linux']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Disable Interactive Connectivity Establishment (ICE for operation.
Restrict network access to the ICE service using firewalls or VLAN segmentation to limit exposure to trusted hosts.
Apply the vendor’s security patch for Poly Trio 8300, 8500, or 8800 as soon as it becomes available from HP support.
Monitor HP documentation and vulnerability advisories for updates related to this issue.

Generated by OpenCVE AI on August 24, 2026 at 15:53 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 32.2% (32.225% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://support.hp.com/us-en/document/ish_15052661-15052687-16/hpsbpy04083

History

Aug 31, 2026 3:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hp Inc. poly Vvx
CPEs		cpe:2.3:h:hp_inc.:poly_vvx:::linux:::::*
Vendors & Products		Hp Inc. poly Vvx

Jun 1, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 1, 2026 3:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.
Title		Poly Voice – Possible Remote Control of Certain Poly Devices
First Time appeared		Hp Inc. Hp Inc. poly Trio 8300 Hp Inc. poly Trio 8500 Hp Inc. poly Trio 8800
Weaknesses		CWE-121
CPEs		cpe:2.3:h:hp_inc.:poly_trio_8300:::linux:::::* cpe:2.3:h:hp_inc.:poly_trio_8500:::linux:::::* cpe:2.3:h:hp_inc.:poly_trio_8800:::linux:::::*
Vendors & Products		Hp Inc. Hp Inc. poly Trio 8300 Hp Inc. poly Trio 8500 Hp Inc. poly Trio 8800
References		https://support.hp.com/us-en/document/ish_15052661-15052687-16/hpsbpy04083
Metrics		cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`