Weak Password Vulnerability in Yealink Products

CVE-2026-122118

What is CVE-2026-122118?

Certain Yealink products prior to April 15, 2026, are impacted by a vulnerability that employs a default 8-digit numeric pre-shared key (PSK) for Wi-Fi AP function, which offers insufficient strength against brute-force attacks. This can allow unauthorized users to access the network and potentially intercept sensitive Wi-Fi traffic, posing a serious risk to user confidentiality and data integrity. Users are strongly advised to change the default PSK to a more complex and secure alternative.

References