Description
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Yealink T3XW Series Phones
Default version status: unaffected
124.85.0.1 to < 124.87.0.22affected
Yealink T4X Series Phones
Default version status: unaffected
108.85.0.1 to < 108.87.0.23affected
Yealink T5X Series Phones
Default version status: unaffected
96.85.0.1 to < 96.87.0.24affected
Yealink T7X Series Phones
Default version status: unaffected
185.87.0.5 to < 185.87.0.39affected
Yealink SIP-T85W、SIP-T87W
Default version status: unaffected
185.87.0.5 to < 185.87.0.39affected
Yealink AX83H、AX86R
Default version status: unaffected
180.86.0.1 to < 180.87.0.15affected
Yealink CP925
Default version status: unaffected
148.85.0.1 to < 148.87.0.41affected
Yealink CP935W
Default version status: unaffected
149.85.0.1 to < 149.87.0.41affected
Yealink MP E2 Teams Series
Default version status: unaffected
176.15.0.1 to < 176.15.0.191affected
Yealink VP59 Teams
Default version status: unaffected
91.15.0.1 to < 91.15.1.37affected
Yealink SIP-T58W
Default version status: unaffected
150.86.0.5 to < 150.87.0.22affected
Yealink VP59
Default version status: unaffected
91.86.0.5 to < 91.87.0.27affected
Yealink CP965
Default version status: unaffected
143.86.0.5 to < 143.87.0.27affected