*CNVD Dictionary Entry**: NVDB-CNVDB-2024107354

DATE PUBLISHED: March 6, 2024  

DATE UPDATED: March 6, 2024

Please Note:

Yealink takes the security of our customers and our products seriously. This is a living document and may be subject to updates.The latest version of this document can be found at the following URL: https://www.yealink.com/trust-center-resource

Vulnerability Summary

The Yealink device management platform’s file upload interface is vulnerable to unauthorized operating system (OS) command injection. Attackers can execute malicious OS commands by carefully crafting a payload during the unauthorized file upload process.

Product Affected

Product Family and Model    |                Affected             |      Fixed    |

———————---------—-    | ———------------------– | —-----—– |

Yealink Device Management |  >=3.5.0.11;<=38.8.0.0 |  >38.8.0.0 |

Solution

Yealink has released software updates to fixed the vulnerability in the new version >=3.5.0.11;<=38.8.0.0 , please update it in time.

The software, release notes, and other documentation for your voice endpoint can be found at: https://support.yealink.com/en/portal/home

Mitigation

Yealink recommends all customers upgrade to the latest version.

Contact

Any customer using an affected system who is concerned about this vulnerability within their deployment should contact Yealink Technical Support by visiting: https://support.yealink.com/en/portal/home for the latest information.

You might also find value in the high-level security guidance and security news located at: https://support.yealink.com/en/portal/home