# CVE-2026-122116: CVE-2026-122116

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.

## Remediation

- fix: We recommend that when enabling Wi-Fi 802.1X, you can restrict the access types of web users by updating security.web_limited_access_level via Auto Provision; for example: security.web_limited_access_level=user. Alternatively, refer to the Admin Guide to configure Wi-Fi permissions for the user account: network-wifi = 2, wifi = 2.

Regarding this vulnerability, newer firmware versions of the device have, by default, restricted 802.1X-related function permissions to administrator-only. (source: CNA: mitre)

## Affected products and versions

- Yealink / T3XW Series Phones: ≥ 124.85.0.1; < 124.87.0.22 (affected, custom). Source: CNA: mitre; platforms: Linux
- Yealink / T4X Series Phones: ≥ 108.85.0.1; < 108.87.0.23 (affected, custom). Source: CNA: mitre; platforms: Linux
- Yealink / T5X Series Phones: ≥ 96.85.0.1; < 96.87.0.24 (affected, custom). Source: CNA: mitre; platforms: Linux
- Yealink / T7X Series Phones: ≥ 185.87.0.5; < 185.87.0.39 (affected, custom). Source: CNA: mitre
- Yealink / SIP-T85W、SIP-T87W: ≥ 185.87.0.5; < 185.87.0.39 (affected, custom). Source: CNA: mitre; platforms: Linux
- Yealink / AX83H、AX86R: ≥ 180.86.0.1; < 180.87.0.15 (affected, custom). Source: CNA: mitre; platforms: Linux
- Yealink / CP925: ≥ 148.85.0.1; < 148.87.0.41 (affected, custom). Source: CNA: mitre; platforms: Linux
- Yealink / CP935W: ≥ 149.85.0.1; < 149.87.0.41 (affected, custom). Source: CNA: mitre; platforms: Linux
- Yealink / MP E2 Teams Series: ≥ 176.15.0.1; < 176.15.0.191 (affected, custom). Source: CNA: mitre; platforms: Android
- Yealink / VP59 Teams: ≥ 91.15.0.1; < 91.15.1.37 (affected, custom). Source: CNA: mitre; platforms: Android
- Yealink / SIP-T58W: ≥ 150.86.0.5; < 150.87.0.22 (affected, custom). Source: CNA: mitre; platforms: Android
- Yealink / VP59: ≥ 91.86.0.5; < 91.87.0.27 (affected, custom). Source: CNA: mitre; platforms: Android
- Yealink / CP965: ≥ 143.86.0.5; < 143.87.0.27 (affected, custom). Source: CNA: mitre; platforms: Android

## Severity and prioritization

- CVSS 3.1: 4.3 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L; source: CNA: mitre

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.yealink.com/en/trust-center/security-bulletins/wifi-8021x-peap-authentication-credential-leakage-vulnerability (CNA: mitre)

## Provenance

- CNA: mitre: https://www.cve.org/CVERecord?id=CVE-2026-122116; retrieved 2026-11-04; source updated 2026-11-04

Revision: f7f55220dfa3024f3681896d2dd77fbdb8067e565e7e41bc889c7aa1303131c4

Canonical: https://y2.dev/cve/CVE-2026-122116

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.