Poly CCX CVE-2026-2891

Exploitation requires the affected Poly device (CCX, Trio C60, or Edge E) to connect to a malicious or attacker-controlled SIP server and receive malformed data - reflected in the CVSS AT:P (attack requirement) metric. Concretely, the attacker must either operate/compromise the SIP server the device registers to, redirect the device to a rogue server, or hold a man-in-the-middle position on the SIP signaling path; a device talking only to a trusted, uncompromised SIP server over an authenticated/encrypted channel is not exposed. No authentication or user interaction is needed (PR:N/UI:N), and impact is limited to availability (device becomes inoperable) with no data compromise. This conditional dependency on attacker-influenced SIP infrastructure is the primary factor limiting real-world exploitation.

The vendor CVSS 4.0 score is 8.2 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and impact isolated to availability (VA:H; VC/VI = N), which is internally consistent: this is a pure denial-of-service with no confidentiality or integrity impact. The key limiting signal is AT:P (attack requirement present) - exploitation is not fully unconditional; it requires the device to connect to and receive data from a malicious or malicious-acting SIP server, i.e. a man-in-the-middle position, a rogue/compromised SIP server, or a device pointed at an attacker-controlled server. No EPSS score, POC, or KEV entry is provided in the input, so real-world exploitation pressure appears low-to-moderate and likely opportunistic rather than mass-scalable. The realistic priority is moderate: high impact for organizations whose endpoints can reach untrusted SIP infrastructure, but meaningfully constrained where SIP traffic stays on trusted internal networks. No conflicting signals are present, though EPSS and POC status are simply absent from the data.

An attacker who controls or has compromised a SIP server, or who achieves a man-in-the-middle position on the signaling path, sends malformed SIP data to a Poly CCX, Trio C60, or Edge E endpoint during normal registration or call handling. The malformed response triggers resource exhaustion in the device's SIP stack, causing it to hang or crash and become inoperable, disrupting voice communications until it is recovered. No public POC is identified in the available data.