CVE-2026-122116: Medium severity vulnerability
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict Wi-Fi 802.1X configuration access to administrator-only users by setting security.web_limited_access_level=user through Auto Provision, or configure the user account permissions network-wifi=2 and wifi=2 according to the Admin Guide.
Yealink Wi-Fi 802.1X security.web_limited_access_level; network-wifi; wifi = user; 2; 2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs at least low-level privileges on an affected Yealink terminal device. The vulnerability concerns access to 802.1X PEAP Wi-Fi configuration credentials by unauthorized users.
Are default configurations affected?
The latest Yealink firmware restricts 802.1X configuration modification privileges to administrator accounts by default. Devices running firmware released before 2026-04-21 may not have that default restriction.
What is the mitigation if firmware cannot be updated immediately?
Restrict access to affected devices so unauthorized or low-privileged users cannot modify or access the Wi-Fi 802.1X PEAP network configuration. Limit administrator credentials and review who has device-level accounts.