CVE-2026-7208
Received Received - Intake

Race Condition in Yealink SIP-T33G Firmware

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-7208
EUVD
EUVD-2026-77476

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
yealink sip-t33g to 124.87.0.0 (exc)
yealink sip-t33g 124.87.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7208 is a race condition vulnerability in Yealink SIP-T33G firmware versions prior to 124.87.0.0. It allows authenticated attackers to disrupt active diagnostic processes by concurrently deleting output files from predictable paths during diagnostic operations like traceroute or ping. This causes the process to crash and leaves the device in an inconsistent state.

Detection Guidance

To detect this vulnerability, monitor for unusual diagnostic process terminations or file deletion activities in the Yealink SIP-T33G device logs. Check if the device is running firmware versions prior to 124.87.0.0. Inspect network traffic for concurrent file operations during diagnostic commands like traceroute or ping.

Impact Analysis

This vulnerability could allow attackers with valid credentials to crash diagnostic tools on the device, potentially causing service disruptions or leaving the system unstable. It does not directly expose data but may impact device reliability and availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by compromising the integrity of diagnostic processes on the Yealink SIP-T33G device. Unauthorized disruption of diagnostic operations may lead to inconsistent system states, which could affect the confidentiality and integrity of communications. However, the provided context does not explicitly detail compliance impacts.

Mitigation Strategies

Immediately update the Yealink SIP-T33G firmware to version 124.87.0.0 or later. Ensure strong authentication for web access to the device. Disable unnecessary diagnostic features if not required. Monitor for any signs of exploitation or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart