CVE-2026-0754

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0754", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "state": "PUBLISHED", "assignerShortName": "hp", "dateReserved": "2026-01-08T21:27:11.945Z", "datePublished": "2026-03-03T00:48:06.776Z", "dateUpdated": "2026-03-03T14:38:08.616Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "VVX", "vendor": "HP Inc", "versions": [{"lessThan": "<UCS 6.4.8", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Edge E", "vendor": "HP Inc", "versions": [{"lessThan": "<PVOS 8.5.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Trio 8300", "vendor": "HP Inc", "versions": [{"lessThan": "<UCS 8.1.7.c", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.</span>"}], "value": "An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.2, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "CWE-321", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2026-03-03T00:48:06.776Z"}, "references": [{"url": "https://support.hp.com/us-en/document/ish_14269649-14269682-16/hpsbpy04081"}], "source": {"discovery": "UNKNOWN"}, "title": "SIP Service Providers \u2013 Possible Impersonation of Poly Voice Device", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T14:37:58.304323Z", "id": "CVE-2026-0754", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T14:38:08.616Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0754", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T14:37:58.304323Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T14:38:04.086Z"}}], "cna": {"title": "SIP Service Providers \u2013 Possible Impersonation of Poly Voice Device", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HP Inc", "product": "VVX", "versions": [{"status": "affected", "version": "0", "lessThan": "<UCS 6.4.8", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "HP Inc", "product": "Edge E", "versions": [{"status": "affected", "version": "0", "lessThan": "<PVOS 8.5.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "HP Inc", "product": "Trio 8300", "versions": [{"status": "affected", "version": "0", "lessThan": "<UCS 8.1.7.c", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.hp.com/us-en/document/ish_14269649-14269682-16/hpsbpy04081"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321"}]}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2026-03-03T00:48:06.776Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0754", "state": "PUBLISHED", "dateUpdated": "2026-03-03T14:38:08.616Z", "dateReserved": "2026-01-08T21:27:11.945Z", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "datePublished": "2026-03-03T00:48:06.776Z", "assignerShortName": "hp"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VVX", "vendor": "HP Inc", "versions": [{"lessThan": "<UCS 6.4.8", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Edge E", "vendor": "HP Inc", "versions": [{"lessThan": "<PVOS 8.5.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Trio 8300", "vendor": "HP Inc", "versions": [{"lessThan": "<UCS 8.1.7.c", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "hp-security-alert@hp.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate."}, {"lang": "es", "value": "Una clave de prueba y un certificado incrustados podr\u00edan extraerse de un dispositivo Poly Voice utilizando herramientas especializadas de ingenier\u00eda inversa. Este certificado extra\u00eddo podr\u00eda ser aceptado por un proveedor de servicios SIP si el proveedor de servicios no realiza una validaci\u00f3n adecuada del certificado del dispositivo."}], "id": "CVE-2026-0754", "lastModified": "2026-06-17T10:11:19.470", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "hp-security-alert@hp.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0754", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T14:37:58.304323Z", "version": "2.0.3"}}]}, "published": "2026-03-03T02:16:07.320", "references": [{"source": "hp-security-alert@hp.com", "url": "https://support.hp.com/us-en/document/ish_14269649-14269682-16/hpsbpy04081"}], "sourceIdentifier": "hp-security-alert@hp.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "hp-security-alert@hp.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,PVOS 8.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}]}, "product": "edge_e", "vendor": "hp"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,UCS 8.1.7.c)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}]}, "product": "trio_8300", "vendor": "hp"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,UCS 6.4.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}]}, "product": "vvx", "vendor": "hp"}], "analysis": {"en": {"generated_at": "2026-04-17T13:26:04.433047+00:00", "value": {"mitigation_remediation": ["Apply any HP firmware update that removes or secures the embedded test key.", "Configure the SIP service provider to enforce strict certificate validation and reject test or self\u2011signed certificates.", "Replace or invalidate the device\u2019s embedded test certificate and deploy a production certificate."], "summary": {"action": "Assess Impact", "impact": "Device Impersonation via SIP"}, "threat_synthesis": {"affected_systems": "HP Inc Edge E, HP Inc Trio\u202f8300, and HP Inc VVX Poly Voice devices are susceptible. Version details are not explicitly listed in the advisory, so any firmware that includes the embedded test key may be affected.", "description_and_impact": "An embedded test key and certificate within certain Poly Voice devices can be extracted with specialized reverse\u2011engineering tools. If a SIP service provider accepts this extracted credential without enforcing proper certificate validation, an attacker can impersonate the legitimate device, potentially gaining unauthorized access to voice communications and data. This vulnerability is classified as CWE-321, indicating insecure management of cryptographic keys.", "risk_and_exploitability": "The score of 8.2 reflects a high\u2011severity flaw, yet the EPSS score is under 1\u202f%, suggesting low exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. Attackers must obtain the embedded key via reverse engineering and rely on a SIP provider that does not verify device certificates. The limited scope implies that exploitation is feasible mainly where the service provider\u2019s validation is lax."}}}}, "created": "2026-03-04T14:54:38.392182+00:00", "updated": "2026-04-17T13:30:19.604019+00:00", "vendors": ["hp", "hp$PRODUCT$edge_e", "hp$PRODUCT$trio_8300", "hp$PRODUCT$vvx"]}