Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2026-122118

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this w

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Yealink AVHub

Default version status: unaffected

  • 0 to < 153.135.0.76affected

Yealink UVC86

Default version status: unaffected

  • 0 to < 151.435.0.66affected

Yealink SmartVision 80

Default version status: unaffected

  • 0 to < 321.435.0.86affected

Yealink UVC40 E2

Default version status: unaffected

  • 0 to < 319.410.0.66affected

Yealink MeetingBorard C

Default version status: unaffected

  • 0 to < 328.321.0.40affected

Yealink MeetingBar A10

Default version status: unaffected

  • 0 to < 278.320.0.86affected

Yealink MeetingBar A40

Default version status: unaffected

  • 0 to < 289.320.0.81affected

Yealink MeetingBar A50

Default version status: unaffected

  • 0 to < 323.320.0.54affected

References