CVE-2025-52918

Description

Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://www.yealink.com/en/trust-center/security-advisories/1318c5efb82e4526 ↗
• https://support.yealink.com/en/portal/knowledge/show?id=646b44278ef325311f38303f ↗
• https://seclists.org/fulldisclosure/2025/Jun/20 ↗
• https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/ ↗