Root on Your Conference Phone: HP Poly Flaw Turns VoIP Hardware Into an AI Deepfake Feed
A CVSS 9.2 stack overflow in HP Poly's ICE implementation hands attackers unauthenticated root and a front-row seat to every executive call.
Key points
- CVE-2026-0826 scores 9.2 on the CVSS scale and allows unauthenticated root access on affected HP Poly conference phones.
- The overflow lives in
ParseICECandidateinside thepolyappbinary; a missing length check on a 256-byte buffer is the entire problem. - ASLR is enabled but broken: shared library load addresses never change, making a return-oriented programming exploit straightforward.
- Affected devices include the full VVX series and the Trio 8300, 8500 and 8800; patches are available now.
- A working Metasploit module is already public, lowering the bar to exploitation to a few keystrokes.
What is the actual vulnerability?
HP has patched a critical buffer overflow in several of its Poly IP conference phones. The bug, CVE-2026-0826, scores 9.2 on the CVSS scale. An unauthenticated attacker can reach root on the device's operating system without touching a credential.
The vulnerable code sits in a helper function called ParseICECandidate inside the polyapp binary. When the Interactive Connectivity Establishment (ICE) feature is active, the function parses Session Description Protocol attributes from incoming SIP INVITE requests. A memcpy call copies the incoming string into a 256-byte stack buffer with no length check. Send a candidate attribute longer than 256 bytes and you have your overflow: textbook stack smashing wrapped in VoIP protocol layers.
Rapid7 researcher Stephen Fewer found the flaw. His team also released a working Metasploit exploit module, so the bar is now download and run.
Does ASLR protect you here?
ASLR is enabled on the affected devices, but it does not randomize the load addresses of shared object libraries, libc included. Those addresses stay fixed across reboots. Fewer's exploit builds a return-oriented programming (ROP) chain against those fixed addresses and calls system() to execute arbitrary OS commands. Broken ASLR turning a buffer overflow into a reliable exploit is a story as old as embedded Linux. It keeps showing up.
Which devices and which firmware fixes it?
Affected hardware covers the entire HP Poly VVX series and the Trio 8300, 8500 and 8800 conference devices. Fixed versions are UCS 6.4.8 for VVX, 8.1.7 for Trio 8300, and 7.2.8 for Trio 8500 and 8800. ICE is off by default; HP advises disabling it if you're not using it.
Should you worry about the AI deepfake angle?
This is where the story gets harder to dismiss. Conference phones sit at the center of calls where sensitive decisions get made. Rapid7's director of vulnerability intelligence Douglas McKee, writing on the Rapid7 blog, was direct: attackers no longer need massive audio datasets to do something useful with synthetic speech tooling. A few minutes of clean source audio from the right person is enough. McKee's concern goes beyond eavesdropping: voice infrastructure, he noted, can now serve both traditional espionage and AI-enabled fraud from a single persistent foothold.
Embedded VoIP hardware gets skipped by most endpoint detection and response tools. It sits on the network, largely unmonitored, for years. Patch now, audit ICE status across your Poly fleet, and treat these devices the way you'd treat any internet-reachable Linux host. That's exactly what they are.
