Read the docs
TI-2026-85120 Aliases CVE-2026-122118GHSA-763v-w5mm-jf4f

Weak default Wi-Fi AP pre-shared key in Yealink products

Priority LOW 32CWE-334Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Certain Yealink products before 2026-04-15 use a default 8-digit numeric pre-shared key when the Wi-Fi AP function is enabled, which gives a small space of random values (CWE-334). An attacker on an adjacent network can brute-force the key without privileges or user interaction, gaining unauthorized network access and intercepting Wi-Fi traffic.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed AVHub (Yealink): 153.135.0.76UVC86 (Yealink): 151.435.0.66+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YealinkAVHubbefore 153.135.0.76153.135.0.76Patch availableCNA
YealinkUVC86before 151.435.0.66151.435.0.66Patch availableCNA
YealinkSmartVision 80before 321.435.0.86321.435.0.86Patch availableCNA
YealinkUVC40 E2before 319.410.0.66319.410.0.66Patch availableCNA
YealinkMeetingBorard Cbefore 328.321.0.40328.321.0.40Patch availableCNA
YealinkMeetingBar A10before 278.320.0.86278.320.0.86Patch availableCNA
YealinkMeetingBar A40before 289.320.0.81289.320.0.81Patch availableCNA
YealinkMeetingBar A50before 323.320.0.54323.320.0.54Patch availableCNA
  • AVHub VendorYealink Affected before 153.135.0.76 Fixed in 153.135.0.76 Patch available CNA
  • UVC86 VendorYealink Affected before 151.435.0.66 Fixed in 151.435.0.66 Patch available CNA
  • SmartVision 80 VendorYealink Affected before 321.435.0.86 Fixed in 321.435.0.86 Patch available CNA
  • UVC40 E2 VendorYealink Affected before 319.410.0.66 Fixed in 319.410.0.66 Patch available CNA
  • MeetingBorard C VendorYealink Affected before 328.321.0.40 Fixed in 328.321.0.40 Patch available CNA
  • MeetingBar A10 VendorYealink Affected before 278.320.0.86 Fixed in 278.320.0.86 Patch available CNA
  • MeetingBar A40 VendorYealink Affected before 289.320.0.81 Fixed in 289.320.0.81 Patch available CNA
  • MeetingBar A50 VendorYealink Affected before 323.320.0.54 Fixed in 323.320.0.54 Patch available CNA

Remediation

Upgrade AVHub to 153.135.0.76, UVC86 to 151.435.0.66, SmartVision 80 to 321.435.0.86, UVC40 E2 to 319.410.0.66, MeetingBorard C to 328.321.0.40, MeetingBar A10 to 278.320.0.86, MeetingBar A40 to 289.320.0.81 and MeetingBar A50 to 323.320.0.54.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA AVHub (Yealink) Fixed in 153.135.0.76
  • Fix · CNA UVC86 (Yealink) Fixed in 151.435.0.66
  • Fix · CNA SmartVision 80 (Yealink) Fixed in 321.435.0.86
  • Fix · CNA UVC40 E2 (Yealink) Fixed in 319.410.0.66
  • Fix · CNA MeetingBorard C (Yealink) Fixed in 328.321.0.40
  • Fix · CNA MeetingBar A10 (Yealink) Fixed in 278.320.0.86
  • Fix · CNA MeetingBar A40 (Yealink) Fixed in 289.320.0.81
  • Fix · CNA MeetingBar A50 (Yealink) Fixed in 323.320.0.54

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122118
  2. 2026-11-04 Alias added: GHSA-763v-w5mm-jf4f
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2021-09018 Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-41051 An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker… CVSS 3.1HIGH 8.8
  • TI-2023-23573 An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to… CVSS 3.1HIGH 8.8
  • TI-2026-10514 Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow CVSS 4.0HIGH 8.6
  • TI-2026-10512 Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow CVSS 4.0HIGH 8.6
  • TI-2026-10510 Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow CVSS 4.0HIGH 8.6
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences