YYealink

Products

Exploited and recent CVEs

• CVE-2026-122148 High 8.2 In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass 0.2%
• CVE-2026-122124 Medium 6.1 On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be 0.1%
• CVE-2026-122120 Critical 9.0 In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution. 0.5%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122118 High 7.4 In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-fo 0.2%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-122116 Medium 4.3 Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network a 0.3%
• CVE-2026-7208 Medium 5.3 Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion 0.3%
• CVE-2026-12223 Medium 5.5 Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection 1.2%
• CVE-2026-12222 High 8.0 Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow 0.4%
• CVE-2026-12221 High 8.0 Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow 0.4%
• CVE-2026-12220 High 8.0 Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow 0.4%
• CVE-2026-12219 Medium 6.3 Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection 1.1%