CVE Dictionary Entry: CVE-2024-28442
DATE PUBLISHED: 2024-04-03
DATE UPDATED: 2024-04-03
Please Note:
Yealink takes the security of our customers and our products seriously. This is a living document and may be subject to updates.
Vulnerability Summary
During a private assessment of Yealink IP Phone MP58/VP59, a security vulnerability was discovered. This vulnerability allows for the retrieval of sensitive files containing usernames and encrypted passwords.
Vulnerability CVSS
CVSS Severity: HIGH
CVSS Score: 7.5
CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Product Affected
Product Family and Model | Affected Software Release | Fixed |
MP5X-Teams | <=122.15.0.115 | 122.15.0.135 |
MP52-Teams | <= 145.15.0.65 | 145.15.0.80 |
VP59-Teams | <=91.15.0.118 | 91.15.0.133 |
CP965-Teams | <=143.15.0.27 | 143.15.0.48 |
DeskVision A24 | No related issues | 156.15.0.24 |
MeetingBar 65/86 | <= 155.15.0.43 | 155.15.0.46 |
MeetingBarA10 | <=278.321.0.11 | 278.321.0.32 |
MeetingBarA20/A30 | <=133.320.0.12 | 133.320.0.35 |
MeetingEye500 | No related issues | 280.320.0.15 |
RoomPanel | <= 147.15.0.40 | 147.520.0.7 |
RoomPanelPlus | <= 269.520.0.9 | 269.520.0.12 |
Roomcast | <= 144.312.0.5 | 144.313.0.1 |
Solution
Yealink has released software updates to fixed the vulnerability in CVE-2024-28442 , please update it in time.
The software, release notes, and other documentation for your voice endpoint can be found at: https://support.yealink.com/en/portal/home
Mitigation
Yealink recommends all customers upgrade to the latest version.
Contact
Any customer using an affected system who is concerned about this vulnerability within their deployment should contact Yealink Technical Support by visiting: https://support.yealink.com/en/portal/home for the latest information.
You might also find value in the high-level security guidance and security news located at: https://support.yealink.com/en/portal/home
