CVE-2026-122116
Received Received - Intake

Improper Access Control in Yealink Terminal Devices

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: MITRE

Description
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-122116
EUVD
EUVD-2026-117010

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-122116 is an improper access control flaw in Yealink terminal devices before 2026-04-21. It allows unauthorized users to access Wi-Fi 802.1X PEAP network authentication credentials due to ordinary users having permission to edit network SSID information when 802.1X with PEAP is enabled.

Detection Guidance

Check if non-admin users can modify 802.1X PEAP network configurations on Yealink devices. Review firmware versions for affected models and verify if web user access types allow unauthorized SSID edits. Use Yealink's admin interface to inspect user permissions for Wi-Fi settings.

Impact Analysis

This vulnerability could expose sensitive Wi-Fi network authentication credentials to unauthorized individuals, potentially allowing them to gain access to restricted networks. Attackers might intercept or misuse these credentials for further network infiltration or data breaches.

Mitigation Strategies
  • Update Yealink devices to the latest firmware where 802.1X configuration changes are restricted to admin accounts only.
  • Disable non-admin user permissions to edit network SSID or Wi-Fi 802.1X settings via Auto Provision or user account configurations.
  • Contact Yealink technical support for guidance on securing affected devices if updates are unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...