HP CCX/Trio C60/Edge E up to 9.49 SIP resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in HP CCX, Trio C60 and Edge E up to 9.49. The impacted element is an unknown function of the component SIP Handler. This manipulation causes resource consumption. This vulnerability is tracked as CVE-2026-2891. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in HP CCX, Trio C60 and Edge E up to 9.49 and classified as problematic. Affected by this vulnerability is an unknown code of the component SIP Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

The following Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they connect to a malicious SIP server and receive malformed data. HP is releasing updates to mitigate these potential vulnerabilities.

It is possible to read the advisory at support.hp.com. This vulnerability is known as CVE-2026-2891 since 02/20/2026. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 9.50 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-41005). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• HP

Name

• CCX
• Edge E
• Trio C60

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8
• 9.9
• 9.10
• 9.11
• 9.12
• 9.13
• 9.14
• 9.15
• 9.16
• 9.17
• 9.18
• 9.19
• 9.20
• 9.21
• 9.22
• 9.23
• 9.24
• 9.25
• 9.26
• 9.27
• 9.28
• 9.29
• 9.30
• 9.31
• 9.32
• 9.33
• 9.34
• 9.35
• 9.36
• 9.37
• 9.38
• 9.39
• 9.40
• 9.41
• 9.42
• 9.43
• 9.44
• 9.45
• 9.46
• 9.47
• 9.48
• 9.49

License

• commercial

Website

• Vendor: https://www.hp.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion