Physical Access Vulnerability in Yealink UVC40 E2 Devices
CVE-2026-122124

6.1MEDIUM

Key Information:

Vendor

Yealink

Status
Uvc40 E2
Vendor
CVE Published:
4 November 2026

What is CVE-2026-122124?

On Yealink UVC40 E2 devices prior to version 319.410.0.71, an attacker can exploit physical access via the USB interface to extract Wi-Fi credentials stored in the firmware. This breach allows unauthorized users to gain root privileges, leading to potential audio and video eavesdropping without triggering any LED alerts on the device. Such vulnerabilities present a significant risk to user privacy and device security.

Affected Version(s)

UVC40 E2 0 < 319.410.0.71

References

https://www.yealink.com/en/trust-center/security-bulletin...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.