# Yealink vulnerabilities Source: https://junglewise.ai/threats/vendors/yealink Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/yealink.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in Yealink: 0 in the last 7 days and 6 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-122148, was published on 4 November 2026. 5 vulnerabilities in the last four weeks, up 400% on the four before (1). 1 critical against 0. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 5 - Last 90 days: 6 - All time: 15 (2 critical, 1 exploited in the wild) ## About Yealink Yealink is a global provider of unified communication and collaboration solutions, specializing in video conferencing, voice communications, and collaboration tools. ## Latest Yealink vulnerabilities - [CVE-2026-122148: Yealink MeetingBoard Pro front-end validation bypass](https://junglewise.ai/threats/cve-2026-122148-in-yealink-meetingboard-pro-before-331-320-0-64-the-web) (info, published 4 Nov 2026) - [CVE-2026-122124: Yealink UVC40 E2 credential theft via USB physical access](https://junglewise.ai/threats/cve-2026-122124-on-yealink-uvc40-e2-devices-before-319-410-0-71-an-attacker-with) (medium, CVSS 6.1, published 4 Nov 2026) - [CVE-2026-122120: Yealink Plug-in Softwares unauthorized file write vulnerability](https://junglewise.ai/threats/cve-2026-122120-in-yealink-plug-in-softwares-before-2-35-219-0-there-is-an) (critical, CVSS 9, published 4 Nov 2026) - [CVE-2026-122118: Yealink Wi-Fi AP weak password vulnerability](https://junglewise.ai/threats/cve-2026-122118-in-certain-yealink-products-before-2026-04-15-when-the-wi-fi-ap) (high, CVSS 7.4, published 4 Nov 2026) - [CVE-2026-122116: Yealink terminal devices improper access control in Wi-Fi 802.1X PEAP](https://junglewise.ai/threats/cve-2026-122116-certain-yealink-terminal-devices-before-2026-04-21-contain-an) (medium, CVSS 4.3, published 4 Nov 2026) - [CVE-2026-7208: Yealink SIP-T33G race condition in diagnostic file deletion](https://junglewise.ai/threats/cve-2026-7208-yealink-sip-t33g-race-condition-in-diagnostic-file-deletion) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-12223: Yealink SIP-T46U command injection in Web FastCGI Service](https://junglewise.ai/threats/cve-2026-12223-yealink-sip-t46u-command-injection-in-web-fastcgi-service) (medium, CVSS 5.5, published 15 Jun 2026) - [CVE-2026-12222: Yealink SIP-T46U stack buffer overflow in Web FastCGI Service](https://junglewise.ai/threats/cve-2026-12222-yealink-sip-t46u-stack-buffer-overflow-in-web-fastcgi-service) (high, CVSS 8, published 15 Jun 2026) - [CVE-2026-12221: Yealink SIP-T46U stack-based buffer overflow in Firmware Chunk Upload Handler](https://junglewise.ai/threats/cve-2026-12221-yealink-sip-t46u-stack-based-buffer-overflow-in-firmware-chunk) (high, CVSS 8, published 15 Jun 2026) - [CVE-2026-12220: Yealink SIP-T46U stack overflow in Firmware Chunk Upload handler](https://junglewise.ai/threats/cve-2026-12220-yealink-sip-t46u-stack-overflow-in-firmware-chunk-upload-handler) (high, CVSS 8, published 15 Jun 2026) - [CVE-2026-12219: Yealink SIP-T46U command injection in Web FastCGI Service](https://junglewise.ai/threats/cve-2026-12219-yealink-sip-t46u-command-injection-in-web-fastcgi-service) (medium, CVSS 6.3, published 15 Jun 2026) - [CVE-2026-12218: Yealink SIP-T46U stack-based buffer overflow in Web FastCGI Service](https://junglewise.ai/threats/cve-2026-12218-yealink-sip-t46u-stack-based-buffer-overflow-in-web-fastcgi) (high, CVSS 8, published 15 Jun 2026) - [CVE-2025-66737: Yealink T21P_E2 directory traversal in diagnostic component](https://junglewise.ai/threats/cve-2025-66737-yealink-t21p-e2-directory-traversal-in-diagnostic-component) (medium, CVSS 4.3, published 26 Dec 2025) - [CVE-2025-66738: Yealink T21P_E2 command injection in diagnostic ping function](https://junglewise.ai/threats/cve-2025-66738-yealink-t21p-e2-command-injection-in-diagnostic-ping-function) (high, CVSS 8.8, published 26 Dec 2025) - [CVE-2021-27561: Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability](https://junglewise.ai/threats/cve-2021-27561-yealink-device-management-server-side-request-forgery-ssrf) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) ## Most severe Yealink vulnerabilities - [CVE-2021-27561: Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability](https://junglewise.ai/threats/cve-2021-27561-yealink-device-management-server-side-request-forgery-ssrf) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2026-122120: Yealink Plug-in Softwares unauthorized file write vulnerability](https://junglewise.ai/threats/cve-2026-122120-in-yealink-plug-in-softwares-before-2-35-219-0-there-is-an) (critical, CVSS 9, published 4 Nov 2026) - [CVE-2025-66738: Yealink T21P_E2 command injection in diagnostic ping function](https://junglewise.ai/threats/cve-2025-66738-yealink-t21p-e2-command-injection-in-diagnostic-ping-function) (high, CVSS 8.8, published 26 Dec 2025) - [CVE-2026-12222: Yealink SIP-T46U stack buffer overflow in Web FastCGI Service](https://junglewise.ai/threats/cve-2026-12222-yealink-sip-t46u-stack-buffer-overflow-in-web-fastcgi-service) (high, CVSS 8, published 15 Jun 2026) - [CVE-2026-12221: Yealink SIP-T46U stack-based buffer overflow in Firmware Chunk Upload Handler](https://junglewise.ai/threats/cve-2026-12221-yealink-sip-t46u-stack-based-buffer-overflow-in-firmware-chunk) (high, CVSS 8, published 15 Jun 2026) - [CVE-2026-12220: Yealink SIP-T46U stack overflow in Firmware Chunk Upload handler](https://junglewise.ai/threats/cve-2026-12220-yealink-sip-t46u-stack-overflow-in-firmware-chunk-upload-handler) (high, CVSS 8, published 15 Jun 2026) - [CVE-2026-12218: Yealink SIP-T46U stack-based buffer overflow in Web FastCGI Service](https://junglewise.ai/threats/cve-2026-12218-yealink-sip-t46u-stack-based-buffer-overflow-in-web-fastcgi) (high, CVSS 8, published 15 Jun 2026) - [CVE-2026-122118: Yealink Wi-Fi AP weak password vulnerability](https://junglewise.ai/threats/cve-2026-122118-in-certain-yealink-products-before-2026-04-15-when-the-wi-fi-ap) (high, CVSS 7.4, published 4 Nov 2026) - [CVE-2026-12219: Yealink SIP-T46U command injection in Web FastCGI Service](https://junglewise.ai/threats/cve-2026-12219-yealink-sip-t46u-command-injection-in-web-fastcgi-service) (medium, CVSS 6.3, published 15 Jun 2026) - [CVE-2026-122124: Yealink UVC40 E2 credential theft via USB physical access](https://junglewise.ai/threats/cve-2026-122124-on-yealink-uvc40-e2-devices-before-319-410-0-71-an-attacker-with) (medium, CVSS 6.1, published 4 Nov 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 400% on the four before (1). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 5 | 1 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Yealink technologies - [Yealink SIP-T46U](https://junglewise.ai/threats/technologies/sip-t46u): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Yealink vulnerabilities", https://junglewise.ai/threats/vendors/yealink, 12 November 2026.