CVE-2025-68644: Authentication Bypass by Spoofing

Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances...

Yealink RPS Information Disclosure / Man-In-The-Middle

Yealink RPS contains several vulnerabilities that can lead to leaking of PII and/or man-in-the-middle attacks. Some vulnerabilities remain unpatched even after disclosure to the manufacturer...

CVE-2025-52917: Allocation of Resources Without Limits or Throttling

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests...

CVE-2025-52919: Improper Certificate Validation

In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded...

CVE-2025-52918: Incorrect Authorization

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces...

CVE-2025-52916: Improper Restriction of Excessive Authentication Attempts

Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration last five digits...