CVE-2026-2891 Details
Description
The following Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they connect to a malicious SIP server and receive malformed data. HP is releasing updates to mitigate these potential vulnerabilities.
A denial-of-service vulnerability has been identified in certain Poly Voice IP devices, including the CCX, Trio, and Edge E models. When these devices connect to a malicious SIP server and receive improperly formatted data, they may become inoperable. HP is releasing updates to address this issue.
Users are advised to ensure that their Poly IP phones connect to SIP servers using a secure connection by enabling TLS. This can be done manually through the phone's web interface or by adding a specific configuration option to the configuration file. HP recommends keeping the system updated with the latest firmware and software.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.hp.com/us-en/document/ish_15222895-15222917-16/hpsbpy04096 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |