CVE-2025-52918

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces...

CVE-2025-52916

Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration last five digits...

CVE-2025-52918

CVE-2025-52918 affects Yealink RPS (Redirect and Provisioning Service). Before 2025-05-26, OpenAPI access is not blocked for frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. CVSS v3.1 base score 5.0 (medium); impact limited to confidentiality. The available docu...

CVE-2025-52919

The CVE-2025-52919 entry describes a vulnerability in Yealink RPS (YMCS RPS) where the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded. Multiple connected sources confirm the affected software and the root cause,...

CVE-2025-52916

The CVE-2025-52916 entry concerns Yealink YMCS RPS prior to 2025-06-04, where the system lacks serial-number verification attempt limits, enabling brute-force enumeration of the last five digits. The issue is supported by multiple connected sources (CVE listing, Red Hat, CNNVD, PT Security, and C...

CVE-2025-52919

In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded...

CVE-2025-52917

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests...

CVE-2025-52916

Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration last five digits...

CVE-2025-52917

The CVE applies to Yealink YMCS RPS API prior to 2025-05-26, where a lack of rate limiting enables information disclosure through excessive requests. Affected component: Yealink RPS API; root cause: missing rate-limiting controls on API endpoints, leading to potential exposure of sensitive data u...

CVE-2025-52917: Allocation of Resources Without Limits or Throttling

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests...

CVE-2025-52916: Improper Restriction of Excessive Authentication Attempts

Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration last five digits...

Yealink YMCS RPS 安全漏洞

Yealink YMCS RPS is a device management cloud service platform with integrated RPS functionality from China Yealink Yealink. A security vulnerability exists in Yealink YMCS RPS versions prior to 2025-06-04, which stems from a lack of SN authentication attempt limitations that could lead to brute...

CVE-2025-52919

In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded...

CVE-2025-52918

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces...

PT-2025-26528 · Yealink · Yealink Ymcs Rps Api

Name of the Vulnerable Software and Affected Versions: Yealink YMCS RPS API versions prior to 2025-05-26 Description: The issue is related to the lack of rate limiting in the Yealink YMCS RPS API, which could potentially enable information disclosure via excessive requests. Recommendations: For...

CVE-2025-52919: Improper Certificate Validation

In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded...

CVE-2025-52918: Incorrect Authorization

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces...

The vulnerability of the Yealink Meeting Server lies in the lack of measures taken at the management level to ensure data hygiene, allowing attackers to execute arbitrary codes.

The vulnerability of the Yealink Meeting Server lies in the lack of measures taken at the management level to protect data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the Yealink Meeting Server, related to the disclosure of information, allows a perpetrator to gain unauthorized access to confidential data.

The vulnerability of the Yealink Meeting Server relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to confidential information...

PT-2025-26527 · Yealink · Yealink Ymcs Rps

Name of the Vulnerable Software and Affected Versions: Yealink YMCS RPS versions prior to 2025-06-04 Description: The issue is related to the lack of SN verification attempt limits, which enables brute-force enumeration of the last five digits. Recommendations: For versions prior to 2025-06-04,...