CVE-2026-122118: High severity vulnerability
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Yealink products affected before 2026-04-15 are exposed when their Wi-Fi AP function is enabled. The issue concerns the default 8-digit numeric PSK used by that function.
What does an attacker need to exploit it?
An attacker needs access to attack the Wi-Fi AP's PSK through brute force. No privileges or user interaction are required according to the supplied vector.
What could an attacker achieve after successful exploitation?
A successful attacker can obtain unauthorized network access and intercept Wi-Fi traffic. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.