Yealink

Records43All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

Yealink records in CISA KEV

Products in the NVD configurations · select one to filter the records

1 record in Device Management · all components

TI-2021-09018 CVE-2021-27561 · GHSA-743m-83p4-9349

CRITICAL 100KEV

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82865 Published 2021-10-15 No fix listed CWE-78