The flaw originates from the device's use of malicious input that is stored within configuration parameters and subsequently rendered as part of its WebUI webpage. This stored cross‑site scripting weakness allows arbitrary script to be embedded into the interface, potentially altering the user experience or executing unauthorized code in the browser of anyone who views the page. The vulnerability is identified with CWE‑79 and does not rely on external network traffic to expose the flaw, but rather on the device's internal handling of configuration values.

HP Inc. offers the vulnerable feature in its Poly CCX, Poly Edge E, and Poly Trio C60 IP phone models. No firmware revision details are supplied, so all current devices that expose their WebUI and accept configuration input may be affected. Users should confirm the model and firmware version against the vendor documentation or support resources to determine applicability.

The assigned CVSS base score of 5.9 reflects moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in practice. The CVE is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves the injection of malicious content into configuration parameters that are then rendered by the WebUI, implying that any entity that can modify these parameters could potentially exploit the flaw. An attacker achieving this injection could alter the WebUI or use the compromised page for further malicious activities.