Yealink vulnerabilities

Products

• Sip-t46u 6
• Rps 5
• Sip-t38g 4
• Ymcs 4
• Meeting Server 3
• Ultra-elegant Ip Phone Sip-t41p Firmware 3
• Vp59 Firmware 3
• Meeting Server 3
• Vp59 Firmware 3
• Configuration Encryption Tool 2
• Sip-t21\(p\)e2 Firmware 2
• Uvc40 E2 2
• Voip Phone Firmware 2

Newest

• yealink meetingboard pro In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end... CVE-2026-122148 8.2 HighNovember 4, 2026
• yealink uvc40 e2 On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can... CVE-2026-122124 6.1 MediumNovember 4, 2026
• yealink plug-in softwares In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability... CVE-2026-122120 9.0 CriticalNovember 4, 2026
• yealink avhub, meetingbar a10, meetingbar a40 +5 more +7 more In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8... CVE-2026-122118 7.4 HighNovember 4, 2026
• yealink ax83h、ax86r, cp925, cp935w +10 more +12 more Certain Yealink terminal devices before 2026-04-21 contain an improper access control... CVE-2026-122116 4.3 MediumNovember 4, 2026
• yealink sip-t33g Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion CVE-2026-7208 6.0 MediumSeptember 14, 2026
• yealink sip-t46u Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection CVE-2026-12223 5.1 MediumJune 15, 2026
• yealink sip-t46u Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow CVE-2026-12222 8.6 HighJune 15, 2026
• yealink sip-t46u Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow CVE-2026-12221 8.6 HighJune 15, 2026
• yealink sip-t46u Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow CVE-2026-12220 8.6 HighJune 15, 2026
• yealink sip-t46u Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection CVE-2026-12219 5.3 MediumJune 15, 2026
• yealink sip-t46u Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow CVE-2026-12218 8.6 HighJune 15, 2026
• yealink meetingbar a30 Yealink MeetingBar A30 Diagnostic command injection CVE-2026-1735 2.4 LowFebruary 2, 2026
• yealink sip-t21\(p\)e2 firmware An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to... CVE-2025-66738 8.8 HighDecember 26, 2025
• yealink sip-t21\(p\)e2 firmware Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged... CVE-2025-66737 4.3 MediumDecember 26, 2025
• yealink rps Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL... CVE-2025-68644 7.4 HighDecember 21, 2025
• yealink sip-t21p e2 Yealink SIP-T21P E2 Local Directory cross site scripting CVE-2025-14228 5.1 MediumDecember 8, 2025
• yealink rps, ymcs +1 more In Yealink YMCS RPS before 2025-05-26, the certificate upload function does not properly validate... CVE-2025-52919 4.3 MediumJune 21, 2025
• yealink rps, ymcs +1 more Yealink YMCS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts,... CVE-2025-52918 5.0 MediumJune 21, 2025
• yealink rps, ymcs +1 more The Yealink YMCS RPS API before 2025-05-26 lacks rate limiting, potentially enabling information... CVE-2025-52917 4.3 MediumJune 21, 2025
• yealink rps, ymcs +1 more Yealink YMCS RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force... CVE-2025-52916 2.2 LowJune 21, 2025
• yealink meeting server Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a... CVE-2024-48353 7.5 HighNovember 1, 2024
• yealink meeting server Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server... CVE-2024-48352 7.5 HighNovember 1, 2024
• ergophone tiptel ip 286 firmware, yealink sip-t28p firmware +1 more Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10... CVE-2024-33109 9.9 CriticalSeptember 19, 2024
• yealink vp59 firmware An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142)... CVE-2024-31747 2.1 LowApril 29, 2024
• yealink vp59 firmware An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a... CVE-2024-30939 6.8 MediumApril 25, 2024
• yealink vp59 firmware Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate... CVE-2024-28442 7.5 HighMarch 26, 2024
• yealink configuration encryption tool Insecure AES key in Yealink Configuration Encrypt Tool below verrsion 1.2. A single, vendorwide,... CVE-2024-24681 9.8 CriticalFebruary 23, 2024
• yealink config encrypt tool add rsa, configuration encryption tool +1 more Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a... CVE-2022-48625 7.5 HighFebruary 19, 2024
• yealink meeting server Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection... CVE-2024-24091 9.8 CriticalFebruary 8, 2024
• yealink sip-t19p-e2 firmware An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute... CVE-2023-43959 8.8 HighOctober 17, 2023
• yealink w60b, w60b firmware +1 more Directory Traversal vulnerability in Contacts File Upload Interface in Yealink W60B version 77.83... CVE-2020-24113 9.1 CriticalAugust 22, 2023
• yealink device management Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1... CVE-2021-27561 In KEV EPSS 82.9% 9.8 CriticalOctober 15, 2021
• yealink ultra-elegant ip phone sip-t41p firmware The diagnostics web interface in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0... CVE-2018-16221 8.0 HighMay 29, 2019
• yealink ultra-elegant ip phone sip-t41p firmware A CSRF (Cross Site Request Forgery) in the web interface of the Yeahlink Ultra-elegant IP Phone... CVE-2018-16218 8.8 HighMay 29, 2019
• yealink ultra-elegant ip phone sip-t41p firmware The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware... CVE-2018-16217 8.8 HighMay 29, 2019
• yealink gigabit color ip phone sip-t32g, gigabit color ip phone sip-t38g, ip phone sip-t19p +11 more +13 more Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in... CVE-2012-1417 Public exploit 3.5 LowSeptember 17, 2014
• yealink sip-t38g cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute... CVE-2013-5758 Public exploit EPSS 11.9% 9.0 HighAugust 3, 2014
• yealink sip-t38g Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated... CVE-2013-5757 Public exploit 4.0 MediumAugust 3, 2014
• yealink sip-t38g Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated... CVE-2013-5756 Public exploit 4.0 MediumAugust 3, 2014
• yealink voip phone firmware CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote... CVE-2014-3427 Public exploit 5.0 MediumJuly 16, 2014
• yealink sip-t38g config/.htpasswd in Yealink IP Phone SIP-T38G has a hardcoded password of (1) user (s7C9Cx.rLsWFA... CVE-2013-5755 Public exploit 10.0 HighJuly 16, 2014
• yealink voip phone, voip phone firmware +1 more Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows... CVE-2014-3428 4.3 MediumJune 16, 2014