In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
Yealink Plug-in Softwares versions before 2.35.219.0 are affected. The provided information does not identify particular operating systems, deployment modes, or feature configurations.
No privileges or user interaction are required according to the supplied vector. Exploitation is network-reachable, although the vulnerability is described as occurring only under specific scenarios and has high attack complexity.
An attacker may exploit the unauthorized file write to achieve remote code execution. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the vulnerable component's security authority.
Upgrade Yealink Plug-in Softwares to version 2.35.219.0 or later. The provided data does not specify any compensating controls for environments where an upgrade cannot be performed immediately.