PatchTheCVEyealink vulnerabilities
Recent CVEs affecting yealink products. 5 tracked.
yealink has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-12-26. Highest priority: CVE-2024-33109 (score 49/100).
- CVE-2025-66737 MEDIUM 4.3 MITIGATE Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal
- CVE-2025-66738 HIGH 8.8 MITIGATE An issue in Yealink T21P_E2 Phone 52.84.0.15 allows a remote normal privileged attacker to execute arbitrary c
- CVE-2024-48352 HIGH 7.5 UPGRADE Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via s
- CVE-2024-33109 CRITICAL 9.9 UPGRADE UPGRADE Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attacker
- CVE-2024-48353 HIGH 7.5 UPGRADE Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS
FAQ
How do I fix yealink vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is yealink being exploited right now?
None of the tracked yealink CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which yealink CVE should I patch first?
CVE-2024-33109 currently ranks highest (49/100): Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attacker.