CVE-2022-48625

Concerning CVE-2022-48625, the vulnerability affects Yealink Config Encrypt Tool versions prior to 1.2, which ships with a built‑in RSA key pair. This design enables potential decryption of encrypted deployment files by an adversary using the default key. The impact is a decryption risk (per the ...

CVE-2022-48625

Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary...

CVE-2024-24091

Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface...

CVE-2024-24091

Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface...

Command injection

Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface...

CVE-2024-24091

Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface...

PT-2024-20263 · Yealink · Yealink Meeting Server

Name of the Vulnerable Software and Affected Versions: Yealink Meeting Server versions prior to 26.0.0.66 Description: The issue is related to an OS command injection vulnerability. This vulnerability can be exploited via the file upload interface. Recommendations: For versions prior to 26.0.0.66...

Yealink Meeting Server Security Vulnerability

Yealink YeaLink Meeting Server is a distributed cloud video conferencing infrastructure from China Yealink Yealink. A security vulnerability exists in Yealink Meeting Server versions prior to v26.0.0.66. An attacker can exploit this vulnerability to perform an operating system command injection...

CVE-2024-24091

CVE-2024-24091 affects Yealink Meeting Server prior to version 26.0.0.66, where an OS command injection vulnerability exists through the file upload interface. This is documented across multiple sources (e.g., Red Hat, CVE lists, PT Security) with the root cause described as command injection via...

CVE-2024-24091

Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface...

The vulnerability of the Yealink Meeting Server lies in the lack of measures taken to neutralize special elements used in the operating system command line. This allows attackers to execute arbitrary commands with root privileges.

The vulnerability of the Yealink Meeting Server exists because measures to neutralize special elements used in the operating system are not taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

PT-2023-8334 · Yealink · Yealink Meeting Server

Name of the Vulnerable Software and Affected Versions: Yealink Meeting Server affected versions not specified Description: The issue exists due to the failure to neutralize special elements used in an operating system command. This could allow a remote attacker to execute arbitrary commands with...

PT-2024-59: OS Command Injection in Yealink Meeting Server (YMS)

The vulnerability was identified in Yealink Meeting Server YMS , versions V26.0.0.66. The discovered vulnerability can be exploited by an internal attacker to execute commands with superuser privileges, which can lead to privilege escalation on the vulnerable host. Vulnerability status: Confirmed...

CVE-2023-43959

An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component...

CVE-2023-43959

An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component...

YeaLink SIP-T19P-E2 OS Command Injection Vulnerability

YeaLink SIP-T19P-E2 is a VOIP phone from China YeaLink. A security vulnerability exists in YeaLink SIP-T19P-E2 version v.53.84.0.15, which originates from a vulnerability that allows a privileged attacker to execute arbitrary code via a specially crafted request via the ping feature of the...

CVE-2020-24113

Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service DoS...

CVE-2020-24113

Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service DoS...

Directory traversal

Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service DoS...

CVE-2020-24113

Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83.0.85, allows attackers to gain sensitive information and cause a denial of service DoS...