CVE-2026-122148

Yealink MeetingBoard Pro versions prior to 331.320.0.64 are affected by a front-end validation bypass vulnerability in the Web management module . An attacker with administrator privileges and local network access can modify the page DOM to bypass UI control logic. This allows the attacker to inv...

EUVD-2026-117018

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot...

CVE-2026-122118

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic...

CVE-2026-122116

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed...

CVE-2026-122124

The Yealink UVC40 E2 devices running firmware versions before 319.410.0.71 are vulnerable to a security flaw where an attacker with short-term physical access can use the USB interface to steal Wi‑Fi credentials . Furthermore, sensitive data within the firmware configuration can be exploited to g...

EUVD-2026-117015

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform aud...

EUVD-2026-117014

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution...

CVE-2026-122120

In Yealink Plug-in Softwares versions prior to 2.35.219.0 , an unauthorized file write vulnerability exists under specific scenarios. This flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and can be exploited by attackers to achieve remote code execution . The vulne...

CVE-2026-122118

Certain Yealink products released before 2026-04-15 are vulnerable when the Wi-Fi AP function is enabled. The root cause is the use of a default 8-digit numeric PSK with insufficient strength, which allows attackers to perform brute-force attacks . This vulnerability can lead to unauthorized netw...

CVE-2026-122118

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic...

EUVD-2026-117012

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic...

CVE-2026-122116

Certain Yealink terminal devices released before 2026-04-21 are impacted by an improper access control vulnerability within the Wi-Fi 802.1X PEAP network configuration function. This flaw allows unauthorized users to access deployed 802.1X network access authentication credentials . To remediate ...

EUVD-2026-117010

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed...

CVE-2026-122116

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed...

YeaLink DM 3.6.0.20 - Remote Command Injection

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. id: CVE-2021-27561 info: name: YeaLink DM 3.6.0.20 - Remote Command Injection author: shifacyclewala,hackergautam severity: critical description: Yealink...

yealink_tools

Yealink firmware reverse engineering This repository contains some script utilities used during the reverse engineering of Yealink VOIP phones firmware. For more information about this research, please read the blogpost...

Yealink DM Command Injection RCE (CVE-2021-27561)

Exploits CVE-2021-27561 in Yealink Device Management 3.6.0.20: unauthenticated command injection via /sm/api/v1/firewall/zone/services zone parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink DM firewall zone command injection CVE-2021-27561.""" import re import urllib.parse from...

CVE-2026-7208

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

CVE-2026-7208

Yealink SIP-T33G IP phones running firmware 124.86.x.x (prior to 124.87.0.0 ) are affected by a race condition in the runtime diagnostic subsystem. An authenticated attacker can trigger a diagnostic operation such as traceroute or ping and concurrently invoke the file-deletion endpoint to remove ...

CVE-2026-7208 Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...