YEALINK IP PHONE- FIRMWARE UNPACKED STATEMENT

Update Time: June 12,2025

Yealink received a vulnerability report submitted to Yealink Security by an external security researcher in May 2025.We are actively processing and evaluating it according to the Yealink Vulnerability Disclosure Process (VDP), acknowledging your concerns about potential vulnerabilities. It is Yealink’s obligation to initiate proactive communication with close partners on vulnerability-related matters. Below is a detailed progress update on the vulnerability remediation:

ISSUE:

1) Firmware Unpacked Issue

Issue 1: ROM package key is lost

There is a vulnerability reported in the firmware encryption mechanism of Yealink VoIP phones. This issue is applicable on versions V86 and below. Attackers can decrypt the firmware through reverse engineering and obtain information data of the ROM file;

Issue 2: Version.bin injection issue

The Version.bin file in the ROM file has a missing security verification mechanism vulnerability, and the digital signature is not perfect. The attacker forges a ROM package file and triggers the upgrade of the device by logging into the device; during the upgrade process, the tampered Version.bin will be executed;

ANALYSIS:

Yealink Statement:

① After decrypting the ROM package file can only obtain some OEM customized information , but cannot control your device;

② The execution of Version.bin only occurs when the controller has the authority to upgrade the device  . In actual scenarios, the device web backend requires an administrator password to log in, which makes it difficult for attackers to direct gain access to device upgrade permissions. In addition, devices with secure boot will be verified when they are upgraded which makes that the attack cannot be executed non-persistently.

SOLUTION:

Mitigation measures:

If you still have concerns, you can solve them by upgrading. 

①Decrypting a ROM package yields only partial OEM customized information (e.g. autop url). Typically customizable information excludes user data. The default firmware is non-OEM-customized. Impact assessments may be conducted based on required customization parameters.

②Build V87 or later resolves the Version.bin execution issue. See the versions below.

For information on supported versions of EOL models, please contact technical support team.

Finally, we promise that safety is Yealink’s persistent goal. We will work with you to continuously improve product safety and address any of your concerns as soon as possible.

We therefore will follow the vulnerability disclosure process to conduct a series of measures after a vulnerability is reported. Currently, we recommend that you follow the above guidelines to ensure safety in this issue.

Reported vulnerability will be disclosed on our website, see: https://www.yealink.com/en/trust-center/security-advisories