Advisoriesby IbisHP Inc.CVE-2026-5922
HP Poly: cross-site scripting
Fix: upgrade to 9.5.0 or later (3 fixed versions below)
The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Poly CCX Product | < 9.5.0 | 9.5.0 |
| Poly Edge E Product | < 8.6.0 | 8.6.0 |
| Poly Trio C60 Product | < 9.5.0 | 9.5.0 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79