CVE-2026-5922

MediumCVSS 5.9

Published: 08/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The IP phone vulnerability allows malicious input stored in configuration parameters to be rendered as content in the WebUI page. An attacker can inject malicious code that executes in the administrator's browser.

Risk Assessment

The risk includes potential session hijacking, credential theft, or unauthorized actions in the IP phone management interface.

Recommendation

Update the IP phone firmware to the latest version provided by the vendor and implement input filtering and sanitization for configuration parameters.

Other vulnerabilities in IP Phone

CVE-2026-5923Medium
The vulnerability allows malicious use of a stolen cookie to modify the contents of the IP phone's webpage.

Original NVD description (English source)

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS