Read the docs
TI-2026-85125 Aliases CVE-2026-122124GHSA-rfxg-v2hf-hwcq

Yealink UVC40 E2 USB interface leaks Wi‑Fi credentials to physical attacker

Priority LOW 26CWE-669Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Yealink UVC40 E2 devices before 319.410.0.71 let an attacker with short-term physical access steal Wi‑Fi credentials through the USB interface. Sensitive data in the firmware configuration can be abused to gain root privileges on the device. An attacker within Wi‑Fi coverage can eavesdrop on audio and video without the device showing an LED alert. The vulnerability is tracked as CWE-669, Incorrect Resource Transfer Between Spheres, with a CVSS 3.1 base score of 6.1 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root privileges on the device. Within Wi‑Fi coverage, the attacker may perform audio and video eavesdropping with no LED alert from the device.

Why it matters now

EPSS 0.00145 3rd percentileScored 2026-11-07
Fix Fixed UVC40 E2 (Yealink): 319.410.0.71

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
YealinkUVC40 E2before 319.410.0.71319.410.0.71Patch availableCNA
  • UVC40 E2 VendorYealink Affected before 319.410.0.71 Fixed in 319.410.0.71 Patch available CNA

Remediation

Update Yealink UVC40 E2 devices to firmware 319.410.0.71 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA UVC40 E2 (Yealink) Fixed in 319.410.0.71

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122124
  2. 2026-11-04 Alias added: GHSA-rfxg-v2hf-hwcq
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 1

  • TI-2021-09018 Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-41051 An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker… CVSS 3.1HIGH 8.8
  • TI-2023-23573 An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to… CVSS 3.1HIGH 8.8
  • TI-2026-10514 Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow CVSS 4.0HIGH 8.6
  • TI-2026-10512 Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow CVSS 4.0HIGH 8.6
  • TI-2026-10510 Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow CVSS 4.0HIGH 8.6
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences