This vulnerability (CVE-2026-2891) involves a denial of service condition (CWE-400) in HP Inc's Poly Voice IP devices such as CCX, Trio, and Edge E. When these devices connect to a malicious SIP server that sends malformed data, they might become inoperable. The CVSS 4.0 base score is 8.2, indicating a high impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. Although HP has indicated that updates will be released to address this vulnerability, no official patch or remediation level is currently documented.

Successful exploitation can cause affected Poly Voice IP devices to become inoperable, resulting in denial of service. This impacts device availability but does not indicate confidentiality or integrity compromise. The vulnerability can be triggered remotely over the network without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. HP has announced forthcoming updates to mitigate this vulnerability. Until patches are available, organizations should consider restricting connections to untrusted SIP servers to reduce exposure.