Critical RCE Vulnerability in HP Poly VoIP Phones Exposes Enterprise Networks Security researchers at Rapid7 have disclosed a critical-severity vulnerability (CVE-2026-0826, CVSS 9.2) in multiple HP Poly Voice VoIP phone models, enabling remote code execution (RCE) with root privileges. The flaw, a stack-based buffer overflow in the parsing of Session Description Protocol (SDP) attributes, affects devices with Interactive Connectivity Establishment (ICE) enabled. The vulnerability stems from an unchecked string copy in the candidate attribute parsing function, allowing attackers to trigger a buffer overflow by sending a maliciously crafted SIP INVITE request. Exploitation grants control over the program counter, registers, and stack data, bypassing ASLR and NX mitigations via Return Oriented Programming (ROP) chains. Successful attacks could lead to arbitrary code execution, providing a persistent foothold in enterprise networks. Affected models include HP VVX series (VVX 150, 250, 350, 450) and Trio IP Conference series (Trio 8800, 8500, 8300) VoIP phones. Patches are available, and disabling ICE connectivity serves as a temporary mitigation. Rapid7’s Douglas McKee highlights the broader risk: these devices, often deployed in trusted environments like conference rooms and executive offices, lack endpoint protection and can be leveraged for eavesdropping, lateral movement, or harvesting sensitive audio for vishing, deepfake attacks, or fraud. The vulnerability underscores the threat posed by unsecured networked devices in high-value corporate settings.