AVHub: Small Space of Random Values
CVE-2026-122118 is a high-severity small space of random values vulnerability in AVHub from Yealink, with a CVSS 3.1 base score of 7.4 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists version 153.135.0.76 as the first without the flaw, so updating AVHub to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update AVHub to 153.135.0.76 or a later version.
- Update UVC86 to 151.435.0.66 or a later version.
- Update SmartVision 80 to 321.435.0.86 or a later version.
- Read the advisory on yealink.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Yealink | AVHub | before 153.135.0.76 | 153.135.0.76 |
| Yealink | UVC86 | before 151.435.0.66 | 151.435.0.66 |
| Yealink | SmartVision 80 | before 321.435.0.86 | 321.435.0.86 |
| Yealink | UVC40 E2 | before 319.410.0.66 | 319.410.0.66 |
| Yealink | MeetingBorard C | before 328.321.0.40 | 328.321.0.40 |
| Yealink | MeetingBar A10 | before 278.320.0.86 | 278.320.0.86 |
| Yealink | MeetingBar A40 | before 289.320.0.81 | 289.320.0.81 |
| Yealink | MeetingBar A50 | before 323.320.0.54 | 323.320.0.54 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. Scored by CNA (mitre.org).
Official description
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Small Space of Random Values
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
How developers prevent this class of flaw
- Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Recent Small Space of Random Values vulnerabilities
- 9.1 Critical severity
Spotted an error? Tell us.