Is CVE-2026-122118 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122118 being exploited in the wild.

How severe is CVE-2026-122118?

High severity, with a CVSS score of 7.4, published 4 November 2026.

Which products and versions are affected?

Yealink Wi-Fi IP Phone; Yealink Teams Rooms System; Yealink Zoom Rooms System.

Is there a fix for CVE-2026-122118?

Yes: fixed in Products patched on or after 2026-04-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122118 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-122118?

Check whether you run Yealink Teams Rooms System, Yealink Wi-Fi IP Phone or Yealink Zoom Rooms System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122118: Yealink Wi-Fi AP weak password vulnerability

CVE-2026-122118 · Severity: high · CVSS 7.4 · Published 2026-11-04

Certain Yealink collaboration devices with Wi-Fi access point functionality use a default 8-digit numeric password that is too weak to resist brute-force attacks. An attacker on the network can crack the password to gain unauthorized access to the Wi-Fi AP, allowing them to intercept traffic and potentially access other networked resources.

Vendors: Yealink.

Quick answers

Is CVE-2026-122118 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122118 being exploited in the wild.
How severe is CVE-2026-122118?: High severity, with a CVSS score of 7.4, published 4 November 2026.
Which products and versions are affected?: Yealink Wi-Fi IP Phone; Yealink Teams Rooms System; Yealink Zoom Rooms System.
Is there a fix for CVE-2026-122118?: Yes: fixed in Products patched on or after 2026-04-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122118 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-122118?: Check whether you run Yealink Teams Rooms System, Yealink Wi-Fi IP Phone or Yealink Zoom Rooms System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Products patched on or after 2026-04-15

Technical details

The vulnerability exists in Yealink products that enable Wi-Fi AP mode with a hardcoded, insufficient-strength PSK comprising only 8 numeric digits. An attacker can perform brute-force attacks against the Wi-Fi authentication to bypass access controls. The issue affects products before the 2026-04-15 patch date; a fix is available from that date forward.

Affected products

Yealink Wi-Fi IP Phone
Yealink Teams Rooms System
Yealink Zoom Rooms System

Timeline

2026-11-04: disclosed

References

https://www.yealink.com/en/trust-center/security-bulletins/wifi-ap-weak-password-vulnerability

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.