# CVE-2026-122118: Yealink Wi-Fi AP weak password vulnerability

Source: https://junglewise.ai/threats/cve-2026-122118-in-certain-yealink-products-before-2026-04-15-when-the-wi-fi-ap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-122118 · Severity: high · CVSS 7.4 · Published 2026-11-04

Certain Yealink collaboration devices with Wi-Fi access point functionality use a default 8-digit numeric password that is too weak to resist brute-force attacks. An attacker on the network can crack the password to gain unauthorized access to the Wi-Fi AP, allowing them to intercept traffic and potentially access other networked resources.

Vendors: [Yealink](https://junglewise.ai/threats/vendors/yealink).

## Quick answers

**Is CVE-2026-122118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122118 being exploited in the wild.

**How severe is CVE-2026-122118?** High severity, with a CVSS score of 7.4, published 4 November 2026.

**Which products and versions are affected?** Yealink Wi-Fi IP Phone; Yealink Teams Rooms System; Yealink Zoom Rooms System.

**Is there a fix for CVE-2026-122118?** Yes: fixed in Products patched on or after 2026-04-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122118 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-122118?** Check whether you run Yealink Teams Rooms System, Yealink Wi-Fi IP Phone or Yealink Zoom Rooms System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Products patched on or after 2026-04-15

## Technical details

The vulnerability exists in Yealink products that enable Wi-Fi AP mode with a hardcoded, insufficient-strength PSK comprising only 8 numeric digits. An attacker can perform brute-force attacks against the Wi-Fi authentication to bypass access controls. The issue affects products before the 2026-04-15 patch date; a fix is available from that date forward.

## Affected products

- Yealink Wi-Fi IP Phone
- Yealink Teams Rooms System
- Yealink Zoom Rooms System

## Timeline

- 2026-11-04: disclosed

## References

- [https://www.yealink.com/en/trust-center/security-bulletins/wifi-ap-weak-password-vulnerability](https://www.yealink.com/en/trust-center/security-bulletins/wifi-ap-weak-password-vulnerability)