CVE-2026-122116
CVE-2026-122116
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.
Fixes and workarounds
Fix
We recommend that when enabling Wi-Fi 802.1X, you can restrict the access types of web users by updating security.web_limited_access_level via Auto Provision; for example: security.web_limited_access_level=user. Alternatively, refer to the Admin Guide to configure Wi-Fi permissions for the user account: network-wifi = 2, wifi = 2. Regarding this vulnerability, newer firmware versions of the device have, by default, restricted 802.1X-related function permissions to administrator-only.
Source: CNA: mitreAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| T3XW Series Phones Yealink Platforms: Linux |
≥ 124.85.0.1; < 124.87.0.22 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| T4X Series Phones Yealink Platforms: Linux |
≥ 108.85.0.1; < 108.87.0.23 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| T5X Series Phones Yealink Platforms: Linux |
≥ 96.85.0.1; < 96.87.0.24 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| T7X Series Phones Yealink |
≥ 185.87.0.5; < 185.87.0.39 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| SIP-T85W、SIP-T87W Yealink Platforms: Linux |
≥ 185.87.0.5; < 185.87.0.39 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| AX83H、AX86R Yealink Platforms: Linux |
≥ 180.86.0.1; < 180.87.0.15 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| CP925 Yealink Platforms: Linux |
≥ 148.85.0.1; < 148.87.0.41 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| CP935W Yealink Platforms: Linux |
≥ 149.85.0.1; < 149.87.0.41 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| MP E2 Teams Series Yealink Platforms: Android |
≥ 176.15.0.1; < 176.15.0.191 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| VP59 Teams Yealink Platforms: Android |
≥ 91.15.0.1; < 91.15.1.37 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| SIP-T58W Yealink Platforms: Android |
≥ 150.86.0.5; < 150.87.0.22 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| VP59 Yealink Platforms: Android |
≥ 91.86.0.5; < 91.87.0.27 (affected, custom)
Other versions: unaffected |
CNA: mitre |
| CP965 Yealink Platforms: Android |
≥ 143.86.0.5; < 143.87.0.27 (affected, custom)
Other versions: unaffected |
CNA: mitre |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 4.3 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L | CNA: mitre |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.