Insecure Encryption Mechanism in Yealink Configuration Encrypt Tool
CVE-2024-24681

9.8CRITICAL

Key Information:

Vendor

Yealink

Status
Yealink Configuration Encrypt Tool
Vendor
CVE Published:
23 February 2024

What is CVE-2024-24681?

A security issue has been identified in the Yealink Configuration Encrypt Tool that involves the use of a hardcoded encryption key for securing provisioning documents. This practice results in a significant weakness because all customer installations utilize the same key, making it easier for attackers to compromise security. Affected versions include the AES version and versions of the RSA variant prior to 1.2. Users of these tools are advised to review security practices and implement stronger, individualized encryption strategies to protect sensitive data.

References

https://github.com/gitaware/CVE/tree/main/CVE-2024-24681
https://seclists.org/fulldisclosure/2024/Feb/22

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.