CVE-2026-5922: IP Phone Stored XSS Vulnerability

CVE-2026-5922 Overview

CVE-2026-5922 is a stored cross-site scripting (XSS) vulnerability affecting HP IP phones. The device accepts malicious input through configuration parameters and renders that input as content within the WebUI page. An authenticated attacker with low privileges can inject script payloads that execute in the browser context of any user who later views the affected WebUI page. HP published a security bulletin describing the issue, and the vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An attacker with low-privilege access can persist JavaScript in phone configuration parameters. The payload executes in the browser of administrators visiting the WebUI, enabling session abuse and configuration tampering.

Affected Products

HP IP phone products referenced in HP Security Bulletin HPSBPY04108
WebUI management interface exposed by affected HP IP phone firmware
Deployments where the WebUI is reachable to authenticated low-privilege users

Discovery Timeline

2026-07-08 - CVE-2026-5922 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-5922

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the WebUI of affected HP IP phones. Configuration parameters accept user-controlled input without proper output encoding. When the WebUI renders those parameters into HTML pages, the browser interprets attacker-controlled content as executable script. The persistence of the payload in device configuration means any subsequent visitor to the affected page triggers execution automatically.

Exploitation requires network reach to the WebUI and low-privilege authenticated access. User interaction is required, because a privileged operator must load the page containing the injected payload for the script to execute. Once triggered, the script runs with the privileges of the viewing user in the WebUI origin, granting access to session tokens, CSRF-relevant DOM state, and any actions the WebUI exposes.

Root Cause

The root cause is missing output encoding when configuration parameter values are rendered into WebUI HTML. The firmware treats stored configuration text as safe display content instead of untrusted data. Standard XSS defenses such as contextual HTML entity encoding and Content Security Policy are absent or incomplete on the affected pages.

Attack Vector

The attack path begins with a low-privileged authenticated user writing a script payload into a configuration parameter using the WebUI or a supported provisioning interface. The device stores the value in persistent configuration. A higher-privileged administrator later browses to a WebUI page that reflects the tainted value. The browser parses the value as HTML and executes the script. The attacker can then perform actions in the administrator's session, exfiltrate session cookies not marked HttpOnly, or modify phone configuration to establish persistence. No verified proof-of-concept exploit code is public. See the HP Security Bulletin for vendor-specific technical detail.

Detection Methods for CVE-2026-5922

Indicators of Compromise

Configuration parameter values containing HTML tags such as <script>, <img onerror=, or javascript: URI schemes
WebUI pages rendering unexpected script execution, redirects, or DOM modifications after administrator login
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled hosts shortly after WebUI access

Detection Strategies

Audit stored configuration parameters on IP phones for HTML or JavaScript syntax that has no legitimate purpose in text fields
Review WebUI access logs for parameter writes originating from low-privileged accounts followed by administrator page views
Inspect browser developer console output when administrators access phone WebUI pages during scheduled maintenance windows

Monitoring Recommendations

Restrict WebUI reachability to a management VLAN and alert on new source IPs authenticating to the phone WebUI
Log and review any changes to phone configuration parameters, particularly free-text fields such as display names and labels
Monitor administrator workstations for anomalous browser-initiated traffic that correlates with IP phone WebUI sessions

How to Mitigate CVE-2026-5922

Immediate Actions Required

Apply the firmware update referenced in HP Security Bulletin HPSBPY04108 to affected IP phones
Rotate WebUI administrator credentials after patching to invalidate any sessions captured through prior exploitation
Audit and sanitize existing configuration parameter values to remove any injected HTML or script content

Patch Information

HP has published remediation guidance in the security bulletin. Refer to HP Security Bulletin HPSBPY04108 for the list of fixed firmware versions and affected device models. Apply the vendor-supplied firmware to all impacted phones before restoring normal management access.

Workarounds

Isolate the phone WebUI to a dedicated management network segment unreachable from user endpoints
Disable or restrict low-privilege WebUI accounts that can modify configuration parameters until firmware is applied
Require administrators to access the WebUI from a hardened jump host with a browser that has scripting restricted for the phone origin

bash

# Example ACL restricting WebUI access to a management subnet
access-list 110 permit tcp 10.10.10.0 0.0.0.255 host <phone-ip> eq 443
access-list 110 deny   tcp any host <phone-ip> eq 443
access-list 110 deny   tcp any host <phone-ip> eq 80