CVE-2026-5922CWE-79
Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack
Medium · published July 8, 2026
What it is
The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.
The record
Technical detail
- CVSS v4.0
- 5.9 · MEDIUM
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00396 · 32.6th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-07-08T21:39Z
EPSS history
Timeline