DATE PUBLISHED: 2025-11-27
DATE UPDATED: 2025-11-27
Please Note:
Yealink takes the security of our customers and our products seriously. This is a living document and may be subject to updates.
Vulnerability Summary
Yealink RPS is vulnerable to third-party spoofing attacks, which could allow unauthorized access to information such as AutoP URL addresses.
Vulnerability CVSS
CVSS Severity: HIGH
CVSS Score: 7.4
CVSS Vector String:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Product Affected
Product Family and Model | Affected | Fixed |
RPS | Prior to 2025-06-27 | Patched on 2025-06-27 |
Resolution Measures
Yealink RPS employs an enhanced multi-factor verification mechanism for dentity authentication, preventing access through third-party spoofing attacks.Yealink released a security update on June 27, 2025, which has been automatically deployed to all cloud service instances.
References
Yealink engaged the independent security firm NetSPI to validate the remediation. Their third-party penetration testing report confirms that the vulnerability has been effectively remediated. For further details, please refer to:
Feedback
For any customers using affected systems who are concerned about this vulnerability in their deployment, please reach out to Yealink technical support for the latest information by visiting Yealink Support. You can also find additional advanced security guidance and helpful content by searching in the Security News section of the Technical Support Center Yealink Support.
