This vulnerability (CVE-2026-5922) involves improper neutralization of input during web page generation (CWE-79) in the Poly CCX IP phone by HP Inc. Malicious input stored in configuration parameters may be rendered directly in the WebUI's webpage, enabling cross-site scripting attacks. The CVSS 4.0 base score is 5.9 (medium severity), with network attack vector, low attack complexity, partial attack traceability, and high impact on integrity. No remediation level or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the WebUI, potentially leading to unauthorized actions or data exposure within the device's management interface. The impact is limited to the WebUI and requires some user interaction and privileges to inject the malicious input. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the device's WebUI to trusted users and networks. Avoid entering untrusted input into configuration parameters that may be rendered in the WebUI.