Exploit module for HP Poly VVX (CVE-2026-0826)#21525

Open

sfewer-r7 wants to merge 7 commits into

rapid7:masterfrom

sfewer-r7:CVE-2026-0826

Commits on Jun 2, 2026

add in exploit module for CVE-2026-0826
sfewer-r7
committed

Commits on Jun 5, 2026

Fix typo in comment

sfewer-r7
and
jvoisin
authored
add a return keyword, otherwise this just falls through (Thanks Copilot\!)
sfewer-r7
committed
version/model validation uses unless version_str || model_str, which allows one to be nil and can lead to NoMethodError on model_str.downcase or a nil ROP lookup. Impact: exploit can crash instead …
sfewer-r7
committed
typo in description
sfewer-r7
committed
rework the version detection logic to support all affected models per the vendor advisory. I dont have a Poly trio device to test, but Recog has user agents strings we can use for the regex when pu…
sfewer-r7
committed
improve the socat bind tcp payload. now get an interactive login shell, avoids the encoding issue for the hp pole module (leverages pty and login instead of " -li"), does not fork (which is inline …
sfewer-r7
committed