Yealink RPS

• CVE-2025-68644 High 7.4 Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to al 0.3%
• CVE-2025-52916 Low 2.2 Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits). 0.3%
• CVE-2025-52917 Medium 4.3 The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests. 0.3%
• CVE-2025-52918 Medium 5.0 Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. 0.3%
• CVE-2025-52919 Medium 4.3 In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded. 0.2%