# CVE-2026-122124: Yealink UVC40 E2 credential theft via USB physical access

Source: https://junglewise.ai/threats/cve-2026-122124-on-yealink-uvc40-e2-devices-before-319-410-0-71-an-attacker-with  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-122124 · Severity: medium · CVSS 6.1 · Published 2026-11-04

The Yealink UVC40 E2 is a video conferencing camera used in meeting rooms. An attacker with brief physical access to the device can extract Wi-Fi credentials and system information through the USB port, potentially gaining root access and enabling unauthorized audio and video eavesdropping without alerting users.

Vendors: [Yealink](https://junglewise.ai/threats/vendors/yealink).

## Quick answers

**Is CVE-2026-122124 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122124 being exploited in the wild.

**How severe is CVE-2026-122124?** Medium severity, with a CVSS score of 6.1, published 4 November 2026.

**Which products and versions are affected?** Yealink UVC40 E2 before 319.410.0.71.

**Is there a fix for CVE-2026-122124?** Yes: fixed in 319.410.0.71. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122124 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-122124?** Check whether you run Yealink UVC40 E2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 319.410.0.71

## Technical details

A physical access vulnerability in the Yealink UVC40 E2 allows extraction of sensitive firmware configuration data via the USB interface, including Wi-Fi credentials and data that can be leveraged to obtain root privileges. The device does not alert users (no LED indication) when eavesdropping occurs once an attacker gains network access through stolen credentials. The attack requires only short-term physical access to the USB port.

## Affected products

- Yealink UVC40 E2 before 319.410.0.71

## Timeline

- 2026-11-04: disclosed

## References

- [https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition](https://www.yealink.com/en/trust-center/security-bulletins/yealink-uvc40-e2-physical-access-via-usb-interface-allows-extraction-of-sensitive-data-and-root-privilege-acquisition)