Yealink vulnerabilities
We track 15 vulnerabilities in Yealink products across 21 products. 15 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 4, 2026.
Latest Yealink vulnerabilities
- 8.2 High severity
MeetingBoard Pro: Client-Side Enforcement of Server-Side Security
In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related int
- 9.0 Critical severity
Plug-in Softwares: Unrestricted Upload of File with Dangerous Type
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
- 7.4 High severity
AVHub: Small Space of Random Values
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercep
- 8.0 High severity
SIP-T46U: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-b
- 8.0 High severity
SIP-T46U: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buf
- 8.0 High severity
SIP-T46U: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to st
- 8.0 High severity
SIP-T46U: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based b
- 8.8 High severity
Sip-t21(p)e2 Firmware: Improper Neutralization of Special Elements used in a Command
An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.
- 7.4 High severity
RPS: Authentication Bypass by Spoofing
Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances.
- 7.5 High severity
meeting_server: Insecure Storage of Sensitive Information
Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information.
- 9.8 Critical severity
tiptel_ip_286_firmware: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.
- 7.5 High severity
yealink_vp59_firmware: Exposure of Sensitive Information to an Unauthorized Actor
Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use function in the company portal component.
- 9.8 Critical severity
Configuration Encryption Tool: Use of Hard-coded Credentials
An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single hardcoded key (used to encrypt provisioning documents) across customers' installations.
- 8.8 High severity
sip-t19p-e2_firmware: Improper Neutralization of Special Elements used in an OS Command
An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping function of the diagnostic component.
- 9.8 Critical severity
Yealink Device Management Server-Side Request Forgery (SSRF) Exploited
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.