CVE-2026-122116
Summary
| CVE | CVE-2026-122116 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-04 18:17:43 UTC |
| Updated | 2026-11-04 20:19:11 UTC |
| Description | Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default. |
Risk And Classification
Primary CVSS: v3.1 4.3 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Problem Types: CWE-863 | CWE-863 CWE-863 Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | CNA | CVSS | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
LowCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Yealink | T3XW Series Phones | affected 124.85.0.1 124.87.0.22 custom | Linux |
| CNA | Yealink | T4X Series Phones | affected 108.85.0.1 108.87.0.23 custom | Linux |
| CNA | Yealink | T5X Series Phones | affected 96.85.0.1 96.87.0.24 custom | Linux |
| CNA | Yealink | T7X Series Phones | affected 185.87.0.5 185.87.0.39 custom | Not specified |
| CNA | Yealink | SIP-T85WSIP-T87W | affected 185.87.0.5 185.87.0.39 custom | Linux |
| CNA | Yealink | AX83HAX86R | affected 180.86.0.1 180.87.0.15 custom | Linux |
| CNA | Yealink | CP925 | affected 148.85.0.1 148.87.0.41 custom | Linux |
| CNA | Yealink | CP935W | affected 149.85.0.1 149.87.0.41 custom | Linux |
| CNA | Yealink | MP E2 Teams Series | affected 176.15.0.1 176.15.0.191 custom | Android |
| CNA | Yealink | VP59 Teams | affected 91.15.0.1 91.15.1.37 custom | Android |
| CNA | Yealink | SIP-T58W | affected 150.86.0.5 150.87.0.22 custom | Android |
| CNA | Yealink | VP59 | affected 91.86.0.5 91.87.0.27 custom | Android |
| CNA | Yealink | CP965 | affected 143.86.0.5 143.87.0.27 custom | Android |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.yealink.com/en/trust-center/security-bulletins/wifi-8021x-peap-authentica... | [email protected] | www.yealink.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: We recommend that when enabling Wi-Fi 802.1X, you can restrict the access types of web users by updating security.web_limited_access_level via Auto Provision; for example: security.web_limited_access_level=user. Alternatively, refer to the Admin Guide to configure Wi-Fi permissions for the user account: network-wifi = 2, wifi = 2. Regarding this vulnerability, newer firmware versions of the device have, by default, restricted 802.1X-related function permissions to administrator-only.
There are currently no legacy QID mappings associated with this CVE.