CVE-2026-122148: High severity vulnerability
In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Yealink MeetingBoard Proto a version that resolves this vulnerability.Fixed in 331.320.0.64 - Operational
Change administrator passwords promptly to strong, complex passwords and review potential credential leakage risks.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Only Yealink MeetingBoard Pro devices running a version before 331.320.0.64 are affected. Exploitation is limited to attackers on the local network who already have a valid administrator account.
What access does an attacker need to exploit it?
The attacker must authenticate with administrator privileges and be able to access the device from the local network. They can then alter the web management page DOM to bypass front-end controls and call screenshot-related interfaces.
Are unauthenticated or remote Internet-based attacks described?
No. The available information states that exploitation requires a valid local-network administrator account; it does not describe unauthenticated exploitation or Internet-based access.
What should be prioritized if remediation cannot happen immediately?
Restrict web management access to trusted local administrators and review who has valid administrator accounts. The reported bypass depends on administrator authentication and local-network reachability.