CVE-2026-0754CWE-321

SIP Service Providers – Possible Impersonation of Poly Voice Device

High · published March 3, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
0.5
In the wild
Unconfirmed
What it is

An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00093 · 0.5th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-03-03T00:48Z
EPSS history
Timeline
  • 03 MAR 00:48Z
    SIP Service Providers – Possible Impersonation of Poly Voice Device
    cvelistv5