https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-31747.htmlhttps://patchthecve.com/cve/CVE-2024-31747.htmlWed, 17 Jun 2026 07:28:42 +0000LOW 2.1: An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) allows a physically proximate attacker to disable the phone lock via the Walkie Talkie menu option.https://patchthecve.com/cve/CVE-2024-28442.htmlhttps://patchthecve.com/cve/CVE-2024-28442.htmlWed, 17 Jun 2026 07:21:27 +0000HIGH 7.5: Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via terms of use function in the company portal component.https://patchthecve.com/cve/CVE-2019-14657.htmlhttps://patchthecve.com/cve/CVE-2019-14657.htmlWed, 17 Jun 2026 02:18:46 +0000HIGH 8.8: Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary https://patchthecve.com/cve/CVE-2019-14656.htmlhttps://patchthecve.com/cve/CVE-2019-14656.htmlWed, 17 Jun 2026 02:18:46 +0000HIGH 8.8: Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.