CVE-2026-0826: Poly Voice – Possible Remote Control of Certain Poly Devices

Synopsis

A stack-based buffer overflow affects Poly Voice products (Poly Trio 8300, 8500, and 8800) running on Linux. The flaw is reachable over the network with no authentication required, but only when an administrator has enabled Interactive Connectivity Establishment (ICE), a protocol used for peer-to-peer media negotiation. Successful exploitation gives an attacker full remote code execution on the device. Patched-image rebuilds at versions 7.2.8 and 8.1.7 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable ICE handling code is exposed over the network, so an attacker must be able to reach the device's signaling or media port from a remote host.

• AuthenticationNot required

  No credentials or session token are needed; the malformed ICE payload can be sent by any unauthenticated remote party.

• Victim interactionNot required

  Exploitation is fully passive from the victim's perspective and requires no user action on the device.

• Attack complexityDetail

  The CVSS base score reflects low inherent complexity, but the AT:P token indicates that exploitation depends on an administrator having enabled ICE, which is not the default configuration on all deployments.

Blast Radius

• An attacker achieves remote code execution on the device, gaining the ability to run arbitrary commands at the privilege level of the affected Poly Voice process.
• Confidential data stored or transiting the device (call recordings, credentials, configuration secrets) is fully readable by the attacker.
• The attacker can modify device configuration, redirect calls, or inject media streams, compromising the integrity of communications handled by the device.
• The attacker can crash or reboot the device, causing a denial of voice service for users depending on that endpoint.