CVE-2026-7208: Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion
Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Yealink SIP-T33Gto a version that resolves this vulnerability.Fixed in 124.87.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the affected SIP-T33G device and able to trigger diagnostic operations and invoke the diagnostic file deletion endpoint. The provided information does not indicate that unauthenticated attackers can exploit it.
What is the practical impact of exploitation?
An attacker can interrupt active diagnostic processes such as traceroute or ping by deleting their predictably located output files concurrently. This terminates the running process and can leave the device in an inconsistent state; the reported impact is limited to availability.
Which firmware versions are affected?
SIP-T33G firmware versions in the 124.86.x.x series before 124.87.0.0 are affected. Firmware 124.87.0.0 is identified as the version at which the issue is addressed.