Vulnerabilities

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability.

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface.

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used.

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function.

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files…

A vulnerability was identified in Yealink SIP-T46U 108.86.0.118.

A vulnerability was determined in Yealink SIP-T46U 108.86.0.118.

A vulnerability was found in Yealink SIP-T46U 108.86.0.118.

A vulnerability has been found in Yealink SIP-T46U 108.86.0.118.

A flaw has been found in Yealink SIP-T46U 108.86.0.118.

A vulnerability was detected in Yealink SIP-T46U 108.87.50.1.

A weakness has been identified in Yealink MeetingBar A30 133.321.0.3.

An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.

Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal.

Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses.

A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15.

In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded.

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests.

Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits).

Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information.

Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID.

Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.

An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) allows a physically proximate attacker to disable the phone lock via the Walkie Talkie menu option.