Read the docs
TI-2026-85118 Aliases CVE-2026-122116GHSA-9q83-h82m-rw63

Improper access control in Yealink phones exposes 802.1X credentials

Priority LOW 20CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

Certain Yealink terminal devices before 2026-04-21 contain an improper access control flaw in the Wi-Fi 802.1X PEAP network configuration function (CWE-863). The flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. An attacker with low privileges on the network can reach these exposed credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Partial T3XW Series Phones (Yealink): 124.87.0.22T4X Series Phones (Yealink): 108.87.0.23+11 more productsRed Hat: 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YealinkT3XW Series Phones124.85.0.1 to before 124.87.0.22124.87.0.22Patch availableCNA
YealinkT4X Series Phones108.85.0.1 to before 108.87.0.23108.87.0.23Patch availableCNA
YealinkT5X Series Phones96.85.0.1 to before 96.87.0.2496.87.0.24Patch availableCNA
YealinkT7X Series Phones185.87.0.5 to before 185.87.0.39185.87.0.39Patch availableCNA
YealinkSIP-T85W、SIP-T87W185.87.0.5 to before 185.87.0.39185.87.0.39Patch availableCNA
YealinkAX83H、AX86R180.86.0.1 to before 180.87.0.15180.87.0.15Patch availableCNA
YealinkCP925148.85.0.1 to before 148.87.0.41148.87.0.41Patch availableCNA
YealinkCP935W149.85.0.1 to before 149.87.0.41149.87.0.41Patch availableCNA
YealinkMP E2 Teams Series176.15.0.1 to before 176.15.0.191176.15.0.191Patch availableCNA
YealinkVP59 Teams91.15.0.1 to before 91.15.1.3791.15.1.37Patch availableCNA
YealinkSIP-T58W150.86.0.5 to before 150.87.0.22150.87.0.22Patch availableCNA
YealinkVP5991.86.0.5 to before 91.87.0.2791.87.0.27Patch availableCNA
YealinkCP965143.86.0.5 to before 143.87.0.27143.87.0.27Patch availableCNA
  • T3XW Series Phones VendorYealink Affected 124.85.0.1 to before 124.87.0.22 Fixed in 124.87.0.22 Patch available CNA
  • T4X Series Phones VendorYealink Affected 108.85.0.1 to before 108.87.0.23 Fixed in 108.87.0.23 Patch available CNA
  • T5X Series Phones VendorYealink Affected 96.85.0.1 to before 96.87.0.24 Fixed in 96.87.0.24 Patch available CNA
  • T7X Series Phones VendorYealink Affected 185.87.0.5 to before 185.87.0.39 Fixed in 185.87.0.39 Patch available CNA
  • SIP-T85W、SIP-T87W VendorYealink Affected 185.87.0.5 to before 185.87.0.39 Fixed in 185.87.0.39 Patch available CNA
  • AX83H、AX86R VendorYealink Affected 180.86.0.1 to before 180.87.0.15 Fixed in 180.87.0.15 Patch available CNA
  • CP925 VendorYealink Affected 148.85.0.1 to before 148.87.0.41 Fixed in 148.87.0.41 Patch available CNA
  • CP935W VendorYealink Affected 149.85.0.1 to before 149.87.0.41 Fixed in 149.87.0.41 Patch available CNA
  • MP E2 Teams Series VendorYealink Affected 176.15.0.1 to before 176.15.0.191 Fixed in 176.15.0.191 Patch available CNA
  • VP59 Teams VendorYealink Affected 91.15.0.1 to before 91.15.1.37 Fixed in 91.15.1.37 Patch available CNA
  • SIP-T58W VendorYealink Affected 150.86.0.5 to before 150.87.0.22 Fixed in 150.87.0.22 Patch available CNA
  • VP59 VendorYealink Affected 91.86.0.5 to before 91.87.0.27 Fixed in 91.87.0.27 Patch available CNA
  • CP965 VendorYealink Affected 143.86.0.5 to before 143.87.0.27 Fixed in 143.87.0.27 Patch available CNA

Remediation

Upgrade T3XW Series Phones to 124.87.0.22, T4X Series Phones to 108.87.0.23, T5X Series Phones to 96.87.0.24, T7X Series Phones, SIP-T85W and SIP-T87W to 185.87.0.39, AX83H and AX86R to 180.87.0.15, CP925 to 148.87.0.41, CP935W to 149.87.0.41, MP E2 Teams Series to 176.15.0.191, VP59 Teams to 91.15.1.37, VP59 to 91.87.0.27, SIP-T58W to 150.87.0.22 and CP965 to 143.87.0.27. Red Hat lists Red Hat Enterprise Linux 9 and other products as affected without a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA T3XW Series Phones (Yealink) Fixed in 124.87.0.22
  • Fix · CNA T4X Series Phones (Yealink) Fixed in 108.87.0.23
  • Fix · CNA T5X Series Phones (Yealink) Fixed in 96.87.0.24
  • Fix · CNA T7X Series Phones (Yealink) Fixed in 185.87.0.39
  • Fix · CNA SIP-T85W、SIP-T87W (Yealink) Fixed in 185.87.0.39
  • Fix · CNA AX83H、AX86R (Yealink) Fixed in 180.87.0.15
  • Fix · CNA CP925 (Yealink) Fixed in 148.87.0.41
  • Fix · CNA CP935W (Yealink) Fixed in 149.87.0.41
  • Fix · CNA MP E2 Teams Series (Yealink) Fixed in 176.15.0.191
  • Fix · CNA VP59 Teams (Yealink) Fixed in 91.15.1.37
  • Fix · CNA SIP-T58W (Yealink) Fixed in 150.87.0.22
  • Fix · CNA VP59 (Yealink) Fixed in 91.87.0.27
  • Fix · CNA CP965 (Yealink) Fixed in 143.87.0.27

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffected—
OpenShift API for Data ProtectionAffected—
Red Hat Certification Program for Red Hat Enterprise Linux 9Affected—
Red Hat Enterprise Linux 9Affected—
Red Hat OpenShift Container Platform 4Affected—
Red Hat OpenShift Container Platform 5Affected—
Red Hat OpenStack Platform 16.2Affected—
Red Hat OpenStack Platform 17.1Affected—
Red Hat OpenStack Platform 18.0Affected—

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122116
  2. 2026-11-04 Alias added: GHSA-9q83-h82m-rw63
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-07 Affected versions changed · Red Hat
  5. 2026-11-07 CVSS score added · Red Hat

References

Other 1

  • TI-2021-09018 Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-41051 An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker… CVSS 3.1HIGH 8.8
  • TI-2023-23573 An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to… CVSS 3.1HIGH 8.8
  • TI-2026-10514 Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow CVSS 4.0HIGH 8.6
  • TI-2026-10512 Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow CVSS 4.0HIGH 8.6
  • TI-2026-10510 Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow CVSS 4.0HIGH 8.6
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences