HP Poly Voice Unauthenticated Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_linux/misc/poly_unauth_rce_cve_2026_0826

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit exploit module for CVE-2026-0826, a stack-based buffer overflow in HP Poly VVX and Trio VoIP phones. It sends a crafted SIP INVITE with a malicious SDP attribute to achieve unauthenticated remote code execution with root privileges.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard exploit for CVE-2026-0826, a stack-based buffer overflow in HP Poly Voice devices. The code constructs a SIP INVITE request with a malicious SDP attribute to trigger the overflow and uses a hardcoded ROP chain to execute a user-supplied payload via system(). No concealed backdoor, deceptive payload, or unrelated harmful behavior was observed. The module's behavior is consistent with its stated purpose of achieving remote code execution on the vulnerable target.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareHP Poly VVX seriesHP Poly Trio 8300HP Poly Trio 8500HP Poly Trio 8800
Attack typesstack-based buffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete exploit that sends a malicious SIP INVITE to trigger a stack-based buffer overflow and execute arbitrary commands via a ROP chain, achieving remote code execution.

modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:111-188

Requirements

  • Target must have Interactive Connectivity Establishment (ICE) enabled.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:22-24
  • Target must be a vulnerable HP Poly VVX or Trio model running a vulnerable firmware version.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:18-20

Observed behavior

  • Sends a SIP OPTIONS request with 'Require: ice' to fingerprint the target device model and firmware version.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:199-210
  • Constructs a buffer overflow payload in an SDP attribute 'a=candidate:' by filling a 256-byte buffer, overwriting saved registers, and using a ROP chain to call libc system() with an attacker-supplied command.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:140-159
  • Sends a crafted SIP INVITE request containing the malicious SDP to trigger the overflow and execute the payload.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:172-185
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

ROP Chain
Hardcoded ROP gadgets for VVX firmware version 6.4.7.4477The exploit uses a fixed ROP chain to redirect execution to libc!system with the attacker's command payload. This is standard exploit technique for the stated vulnerability.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:140-159
Payload Execution
cmd = payload.encoded.to_s; overflow += cmdThe module takes the user-selected Metasploit payload and appends it to the overflow buffer, which is then executed via the ROP chain. This is the intended exploit mechanism.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:114modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:159
SIP Request Construction
SIP INVITE with SDP containing overflowThe module builds a SIP INVITE message with a crafted SDP body that includes the overflow and ROP chain. This is the delivery mechanism for the exploit.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:163-185
Review boundaries

What the analysis did not establish

  • Only the VVX ROP table is provided; Trio models are not supported by the exploit code.
  • The exploit has only been tested with the cmd/unix/bind_socat_tcp payload.
  • The analysis is based solely on the module source code; framework mixins and external payloads are not included.
  • Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not included in the evidence.
  • The review does not assess the safety or reliability of the exploit or its payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1