Yealink vulnerabilities

CVEs per yearBy the year they were published

1. 20256
2. 202613

Newest CVEs

• CVE-2026-122148

  In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator…

  Yealink · MeetingBoard Pro

  High8.2
• CVE-2026-122124

  On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data…

  Yealink · UVC40 E2

  Medium6.1
• CVE-2026-122120

  In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers…

  Yealink · Plug-in Softwares

  Critical9.0
• CVE-2026-122118

  In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used.…

  Yealink · AVHub

  High7.4
• CVE-2026-122116

  Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function.…

  Yealink · T3XW Series Phones

  Medium4.3
• CVE-2026-7208

  Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion

  Yealink · SIP-T33G

  Medium6.0
• CVE-2026-12223

  Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection

  Yealink · SIP-T46U

  Medium5.1
• CVE-2026-12222

  Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow

  Yealink · SIP-T46U

  High8.6
• CVE-2026-12221

  Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow

  Yealink · SIP-T46U

  High8.6
• CVE-2026-12220

  Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow

  Yealink · SIP-T46U

  High8.6