Vulnerability · Published Jul 8, 2026 · Assigned by hp
CVE-2026-5923Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack
Medium 6.0
In plain English
A medium-severity cross-site request forgery in Poly CCX from HP Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 4.0)6.0Medium
Exploit odds (30 days)0.2%top 90.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HP Inc. | Poly CCX | 0 – before 9.50 |
| HP Inc. | Poly Edge E | 0 – before 8.6.0 |
| HP Inc. | Poly Trio C60 | 0 – before 9.5.0 |
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N