CVE-2026-122118
Received Received - Intake

Wi-Fi PSK Brute-Force in Yealink Devices

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: MITRE

Description
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-122118
EUVD
EUVD-2026-117012

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-334 The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects certain Yealink devices with Wi-Fi AP function enabled. It uses a default 8-digit numeric password that is too weak, allowing attackers to guess it via brute-force attacks. This can lead to unauthorized network access and interception of Wi-Fi traffic.

Detection Guidance

Check if any affected Yealink devices have Wi-Fi AP enabled by accessing their admin interface. Look for an 8-digit numeric PSK in the Wi-Fi settings. Use network scanning tools like Wireshark to monitor for unauthorized access attempts or unusual traffic patterns on the Wi-Fi network.

Impact Analysis

Attackers could gain access to your network, intercept sensitive data like passwords or emails, and potentially launch further attacks from your network. This includes monitoring unencrypted traffic or accessing shared resources.

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by allowing unauthorized access to personal or health data transmitted over Wi-Fi. Organizations must ensure secure network access to maintain compliance.

Mitigation Strategies

Immediately change the Wi-Fi AP password to at least 8 characters with three character types and avoid three consecutive identical characters. Upgrade the firmware of affected devices to the latest version and restore factory settings if necessary to regenerate a stronger default password.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122118. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...