Yealink

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Yealink product.

RSS Feeds for Yealink security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Yealink products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Yealink Sorted by Most Security Vulnerabilities since 2018

Yealink Vp59 Firmware3 vulnerabilities

Yealink Meeting Server3 vulnerabilities

Yealink Config Encrypt Tool Add Rsa1 vulnerability

Yealink Configuration Encryption Tool1 vulnerability

Yealink Device Management1 vulnerability

Known Exploited Yealink Vulnerabilities

The following Yealink vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Yealink Device Management Server Pre-Authorization SSRF	Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication CVE-2021-27561 Exploit Probability: 94.1%	November 3, 2021

The vulnerability CVE-2021-27561: Yealink Device Management Server Pre-Authorization SSRF is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 1 vulnerability in Yealink with an average score of 4.3 out of ten. Last year, in 2025 Yealink had 2 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Yealink in 2026 could surpass last years number. Last year, the average CVE base score was greater by 1.15

Year	Vulnerabilities	Average Score
2026	1	4.30
2025	2	5.45
2024	8	8.65
2023	0	0.00
2022	0	0.00
2021	1	9.80

It may take a day or so for new Yealink vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Yealink Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-1735	Feb 02, 2026	Command Injection in Yealink MeetingBar A30 Diagnostic Handler v133.321.0.3 A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This manipulation causes command injection. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-68644	Dec 21, 2025	Unauthorized Access via RPS in Yealink Devices (CVE-2025-68644) Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication mechanism through a security update to all cloud instances.
CVE-2025-14228	Dec 08, 2025	Yealink SIPT21P E2 52.84.0.15 Local Directory Page XSS Remote Exploit A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2024-48353	Nov 01, 2024	Yealink Meeting Server V26 Static Key Exposure Vulnerability Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information.	Yealink Meeting Server
CVE-2024-48352	Nov 01, 2024	Yealink Meeting Server V26 Sensitive Data Exposure Vulnerability Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID.	Yealink Meeting Server
CVE-2024-31747	Apr 29, 2024	Yealink VP59 Firmware 122.15.0.142: Disable Phone Lock via Walkie An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) allows a physically proximate attacker to disable the phone lock via the Walkie Talkie menu option.	Vp59 Firmware
CVE-2024-30939	Apr 25, 2024	Yealink VP59 Teams Ed firmware 91.15.0.118: factory reset flaw allows account takeover An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attacker to gain control of an account via a flaw in the factory reset procedure.	Vp59 Firmware
CVE-2024-28442	Mar 26, 2024	Directory Traversal in Yealink VP59 V.91.15.0.118 via Company Portal Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use function in the company portal component.	Vp59 Firmware
CVE-2024-24681	Feb 23, 2024	Hardcoded Key in Yealink Config Encrypt Tool (AES & RSA <1.2) An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single hardcoded key (used to encrypt provisioning documents) across customers' installations.	Configuration Encryption Tool
CVE-2022-48625	Feb 20, 2024	Yealink Config Encrypt Tool: RSA Key Pair in 1.1 Allows Decryption Attack Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary.	Config Encrypt Tool Add Rsa
CVE-2024-24091	Feb 08, 2024	Yealink Meeting Server v26.0.0.66 OS Command Injection via File Upload interface Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface.	Yealink Meeting Server
CVE-2021-27561	Oct 15, 2021	Yealink Device Management (DM) 3.6.0.20 Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.	Device Management