EUVD-2026-42445
GHSA-gf54-33r5-j829
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires low-privilege config write (PR:L) and admin page view (UI:R); scope changes to browser (S:C) with limited C and I impact, no availability effect.
Primary rating from Vendor (hp).
CVSS VectorVendor: hp
Lifecycle Timeline
2DescriptionCVE.org
The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.
AnalysisAI
Stored cross-site scripting in HP IP phone WebUI allows a low-privileged authenticated attacker to inject malicious script content into configuration parameters, which the phone's web management interface later renders unsanitized to visiting users. When an administrator browses the affected WebUI page, the injected payload executes in their browser session, producing a High integrity impact within the WebUI context. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis; HP has published advisory HPSBPY04108 addressing the issue.
Technical ContextAI
HP IP phones expose a built-in WebUI for device administration and configuration management. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored variant: user-supplied values written to configuration parameters are persisted on the device and subsequently re-emitted into HTML responses without adequate output encoding or sanitization. The CVSS 4.0 vector's AT:P (attack requirements present) confirms that exploitation is not trivially available against default unauthenticated targets - write-level access to configuration storage is a prerequisite. The scope of impact is contained to the vulnerable system's WebUI (SC:N/SI:N/SA:N), meaning the injected script cannot directly pivot to backend telephony infrastructure through this vector alone. No CPE strings were provided in the intelligence data; exact affected models and firmware revisions must be obtained from HP advisory HPSBPY04108.
RemediationAI
Consult HP security advisory HPSBPY04108 at https://support.hp.com/us-en/document/ish_15255534-15255565-16/hpsbpy04108 for the vendor-released patched firmware version - the exact fix version is not independently confirmed from the available intelligence data beyond the advisory URL and must be verified there before deployment. As compensating controls prior to patching, restrict WebUI access to trusted administrator accounts only and isolate the phone management interface to a dedicated management VLAN inaccessible from general user segments, reducing the pool of users who can write to configuration parameters (this directly removes the PR:L attack path). Disabling web-based configuration management in favor of a hardened provisioning server with server-side input validation eliminates the stored XSS surface entirely, though it changes operational workflow and requires provisioning infrastructure. Ensure administrator browsers enforce Content Security Policy and do not store persistent sessions with the phone WebUI to limit the blast radius if payload execution occurs.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today